Security audit

Bank of Bots

Security checks for vulnerabilities and agentic risk

Overview

This skill documents real money movement and operator account administration under a narrower trust-scoring description, so users should review it before installing.

Install only if you intend to give an agent Bank of Bots financial and operator-management authority. Use narrowly scoped credentials, avoid exposing operator keys to ordinary trust-score tasks, require explicit approval before any transfer, payment, webhook change, key rotation, or sub-agent creation, and start with low budgets and server-side limits.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:2
Finding: Financial and Operator Capabilities Exceed the Skill's Declared Trust-Scoring Scope
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:2-7, SKILL.md:84-106, SKILL.md:144-186, SKILL.md:331-341, and SKILL.md:387-414
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

The Skill describes itself as a trust-scoring facility:

yaml
--- name: Bank of Bots description: > Trust scoring for AI agents. Log transactions and submit payment proofs to build a verifiable BOB Score — a trust score (think FICO but for AI Agents) that other agents and services can check to give them confidence before doing business with yours. ---

However, it also documents high-impact financial and operator operations:

bash
bob send <agent-id> <destination> --amount <n> [--currency BTC]

bash
# ACH or wire — requires a saved counterparty bob payments create <agent-id> --amount <cents> --rail ach --counterparty-id <id> # Book transfer — instant, between internal accounts bob payments create <agent-id> --amount <cents> --rail book --to-account-id <id>

bash
bob agent webhooks create <agent-id> --url https://example.com/hook --events payment_intent.complete,payment.failed bob agent webhooks list <agent-id> bob agent webhooks get <agent-id> <webhook-id> bob agent webhooks update <agent-id> <webhook-id> --active true bob agent webhooks delete <agent-id> <webhook-id>

bash
bob agent create --api-key "$BOB_OPERATOR_API_KEY" \ --name "my-worker" \ --operator-id "$BOB_OPERATOR_ID" \ --budget 50000 \ --currency BTC bob agent list --api-key "$BOB_OPERATOR_API_KEY" bob agent rotate-key <sub-agent-id> --api-key "$BOB_OPERATOR_API_KEY"

Technical Analysis

The documented capabilities exceed the least privilege required to log transactions, submit payment proofs, or query a trust score. ...[truncated 2512 chars]
Remediation: View remediation
Remediation Suggestions

Restrict this Skill to trust-score queries, transaction logging, credit-history inspection, and payment-proof submission.

Move payment execution, bank-counterparty management, webhook administration, sub-agent management, and key rotation into separately named Skills.

Require explicit user confirmation immediately before every fund transfer, payment, key rotation, or webhook destination change.

Use separate, narrowly scoped credentials for read-only scoring, proof submission, payment execution, and operator administration.

Do not make operator credentials available to an Agent performing ordinary trust-score tasks.

Enforce server-side allowlists for destinations, webhook hosts, payment rails, and maximum transaction amounts.

Preserve spend limits, rate limits, kill switches, and immutable audit logs as server-side controls.

Clearly state all financial and administrative side effects in the Skill description so selection and authorization decisions reflect its actual capabilities.

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:387
Finding: Operator API Key Is Passed Through Command-Line Arguments
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:387-406
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

The documentation instructs users to supply a privileged operator API key through a command-line option:

bash
# Create a sub-agent under your operator bob agent create --api-key "$BOB_OPERATOR_API_KEY" \ --name "my-worker" \ --operator-id "$BOB_OPERATOR_ID" \ --budget 50000 \ --currency BTC # List agents under your operator bob agent list --api-key "$BOB_OPERATOR_API_KEY" # Rotate a sub-agent's API key bob agent rotate-key <sub-agent-id> --api-key "$BOB_OPERATOR_API_KEY"

The associated flag documentation reinforces this usage:

markdown
| `--api-key` | Required. Use `$BOB_OPERATOR_API_KEY` to authenticate as operator |

Technical Analysis

Although shell variable expansion avoids placing the literal secret in shell source text, it inserts the expanded API key into the bob process argument vector. Depending on the operating system, process isolation, runtime, command wrapper, and monitoring configuration, command arguments may be visible through process-inspection facilities, diagnostic telemetry, audit records, crash reports, or verbose automation logs.

The secret is an operator credential used for privileged sub-agent management. Exposure is therefore more consequential than disclosure of a narrowly scoped read-only key. The project contains no local CLI implementation, so whether the CLI independently redacts arguments or supports a safer authentication mechanism could not be verified.

Attack Path

An operator exports BOB_OPERATOR_API_KEY and follows the documented command.

The shell expands the variable as the value of --api-key.

The expanded secret is included in the running process's argument vector.

A local process observer, privileged monitoring agent, diagnostic collector, command wrapper, or impro ...[truncated 832 chars]
Remediation: View remediation
Remediation Suggestions

Remove secret-bearing --api-key examples from the documentation.

Have the CLI read credentials directly from a designated environment variable without copying them into command-line arguments.

Prefer an operating-system keychain, protected credential file, secret manager, or standard-input mechanism with appropriate access controls.

If a credential file is supported, require restrictive file permissions and prevent it from being committed to source control.

Ensure the CLI and surrounding automation redact authentication data from errors, telemetry, audit output, and debug logs.

Use short-lived, narrowly scoped operator tokens rather than long-lived general-purpose API keys.

Rotate the operator key promptly if process arguments or automation logs may have exposed it.

Document a secure authentication workflow and reserve operator credentials exclusively for explicit administrative tasks.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
ID (overrides --rail lookup) | | --amount | Sats to request (required for lightning) | | --currency | BTC hint when multiple wallets share a rail | | --memo | Optional payment description | | --expiry-seconds | Invoice TTL for lightning (default 900) |

Returns data.instructions with the payable invoice, address, or account details.

One-shot send (auto-quote + execute)

bash
bob send <agent-id> <destination> --amount <n> [--currency BTC]

Destination is auto-detected:

<agent-uuid> → same-operator internal transfer

jade@bankofbots.ai → routes as bob_address (BTC by default)

lnbc... → Lightning invoice (BTC)

bc1.../bcrt1.../tb1... → on-chain BTC address

Flag Description
--amount Required. Smallest currency unit
--currency Override auto-detected currency
--priority cheapest, fastest, or balanced (default: balanced)
--description Optional payment note
--max-fee Maximum acceptable fee

Flag	Description
`--amount`	Required. Smallest currency unit
`--currency`	Override auto-detected currency
`--priority`	cheapest, fastest, or balanced (default: balanced)
`--description`	Optional payment note
`--max-fee`	Maximum acceptable fee

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The skill instructs the agent to send API credentials and financial transaction data to an external service endpoint, which is an external transmission risk by design. While expected for this integration, it is still security-relevant because secrets and sensitive financial metadata leave the local trust boundary and could be exposed through misuse, misconfiguration, or compromise of the third-party service.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
Once connected, you need these credentials for all API calls: - `BOB_API_KEY` — your agent API key - `BOB_AGENT_ID` — your agent ID - `BOB_API_URL` — `https://api.bankofbots.ai/api/v1` You can use the `bob` CLI (optional) or call the REST API directly. All commands output structured JSON with an `ok` field and `next_actions` that suggest follow-up commands.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This section documents commands that can directly move funds or create outbound payments, but it does not prominently warn that these actions have real financial consequences and should require explicit user confirmation. In an agent-skill context, presenting payment execution commands as routine operations increases the risk of accidental or autonomous money movement by downstream agents.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: Exposing --auto-approve as a defaulted option in a skill that manages budgets and payment credentials creates an unsafe autonomy pattern. If an upstream agent follows examples mechanically, it may create and enable subordinate agents without adequate review, compounding financial and operational risk.
Content: Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.
md
| `--budget` | Initial spend budget in smallest currency unit | | `--currency` | USD, BTC, or USDC (default: BTC) | | `--currencies` | Comma-separated list of currencies for wallet creation | | `--auto-approve` | Auto-approve the agent (default: true) | The created sub-agent gets its own API key, wallets, and policies. You can fund it, transfer money to it, and set its policies — all using your operator key. The sub-agent's API key is returned in the response.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: Exposing --auto-approve as a defaulted option in a skill that manages budgets and payment credentials creates an unsafe autonomy pattern. If an upstream agent follows examples mechanically, it may create and enable subordinate agents without adequate review, compounding financial and operational risk.
Content: Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.
md
| `--budget` | Initial spend budget in smallest currency unit | | `--currency` | USD, BTC, or USDC (default: BTC) | | `--currencies` | Comma-separated list of currencies for wallet creation | | `--auto-approve` | Auto-approve the agent (default: true) | The created sub-agent gets its own API key, wallets, and policies. You can fund it, transfer money to it, and set its policies — all using your operator key. The sub-agent's API key is returned in the response.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: Exposing --auto-approve as a defaulted option in a skill that manages budgets and payment credentials creates an unsafe autonomy pattern. If an upstream agent follows examples mechanically, it may create and enable subordinate agents without adequate review, compounding financial and operational risk.
Content: Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.
md
| `--budget` | Initial spend budget in smallest currency unit | | `--currency` | USD, BTC, or USDC (default: BTC) | | `--currencies` | Comma-separated list of currencies for wallet creation | | `--auto-approve` | Auto-approve the agent (default: true) | The created sub-agent gets its own API key, wallets, and policies. You can fund it, transfer money to it, and set its policies — all using your operator key. The sub-agent's API key is returned in the response.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

One-shot send (auto-quote + execute)

External Transmission

Missing User Warnings

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Static analysis