Security audit

Konto

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to support legitimate read-only finance lookups, but it should go through Review because it handles sensitive financial credentials with weak safeguards and includes an analytics command outside its declared personal scope.

Before installing, verify that you trust the Konto service and publisher, use a personal-scoped key for this skill, keep ~/.openclaw/secrets/konto.env private, and ensure KONTO_URL points only to the intended HTTPS Konto endpoint or a deliberate local development server. Avoid placing an analytics-scoped key in this skill's secrets file unless you intentionally want the helper to access analytics data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/konto.sh:2
Finding: Arbitrary Shell Execution Through Sourced Secrets File
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/konto.sh:3
Finding: Bearer Credential Can Be Sent to an Untrusted or Plaintext Endpoint
Content: View full analysis
Remediation: View remediation

other

Note

Location: scripts/konto.sh:13
Finding: Undocumented Analytics Capability Violates the Declared Personal-Only Scope
Content: View full analysis
` using the privileged credential. 4. The server returns cross-user aggregate analytics if the key has the required scope. 5. The resulting data is printed to standard output and may enter logs or downstream agent context. A personal-only key should receive a server-side `403` response, so exploitation depends on a valid analytics-scoped key being configured. ### Impact Assessment The command can retrieve anonymized, ...[truncated 516 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill encourages authenticated requests to a remote service for highly sensitive banking, investment, loan, and transaction data, but does not warn users that personal financial information will be transmitted to and processed by an external endpoint. This creates a real privacy and security risk because users may invoke the skill without understanding the exposure of account balances, transactions, and other sensitive financial details.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file describes endpoints that expose highly sensitive personal financial data such as account balances, transactions, investments, assets, loans, and a full financial snapshot. Under the markdown-specific warning rule, the documentation should disclose that using these endpoints may affect user privacy or expose sensitive financial information, but no such warning is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script sources a local secrets file at L02 and uses the resulting API key in Authorization headers for curl requests at L07-L13. There is no comment, prompt, or user-facing output explaining that credentials will be loaded and sent to a remote service, which is relevant for privacy and safety awareness.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.