Farmos Finance

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:53 PM UTC
• Version: 1.0.0

Overview

The skill is openly about farm finance queries, but it documents sensitive financial access through plaintext HTTP and unauthenticated integration endpoints that conflict with its admin-only policy.

Review before installing. This skill should only be used in a tightly controlled environment after the finance API requires server-side admin authorization on every endpoint and uses HTTPS or another authenticated encrypted transport for bearer tokens and financial data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:27

Finding

Administrator Bearer Token and Financial Data Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–39 and 58–80
Vulnerability Type: Plaintext transmission of privileged credentials and sensitive data
Risk Level: High

Vulnerable Code

markdown

## Authentication

**ADMIN ONLY.** This skill accesses sensitive financial data. Always use admin-level auth.

```bash
TOKEN=$(~/clawd/scripts/farmos-auth.sh admin)

Role mapping: Check ~/.clawdbot/farmos-users.json. If the sender is not admin, respond: "Financial data is restricted to farm owners. I can't access that for your account."

API Base

http://100.102.77.110:8010

text

The authenticated endpoints subsequently send the token through an HTTP authorization header:

```markdown
### Cost Categories
GET /api/categories
Authorization: Bearer {token}

### Cost Items
GET /api/cost-items?crop_year=2025
Authorization: Bearer {token}

### Cash Flow Projection (Full)
GET /api/cash-flow/projection?crop_year=2025
Authorization: Bearer {token}

### Cash Flow Summary
GET /api/cash-flow/summary?crop_year=2025
Authorization: Bearer {token}

Technical Analysis

The Skill obtains an administrator-level bearer token and instructs the agent to use it against an API whose base URL uses plaintext HTTP. HTTP provides neither transport confidentiality nor server authenticity. A bearer token observed in transit can generally be replayed without knowledge of any additional secret.

An attacker with visibility or control over the relevant network path could inspect the authorization header, capture the administrator token, modify API requests or responses, or impersonate the API service. The plaintext financial responses could also be read or manipulated in transit.

Attack Path

1. The agent invokes ~/clawd/scripts/farmos-auth.sh admin and receives an administrator bearer token.
2. The agent sends a request to http://100.102.77.110:8010 with `Authorization: Beare ...[truncated 993 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the HTTP API base with an HTTPS endpoint using a valid, trusted certificate.
• Configure clients to validate the certificate and hostname; do not permit insecure fallback to HTTP.
• Refuse to attach authorization headers to non-HTTPS requests.
• Replace administrator-wide credentials with narrowly scoped, read-only tokens for the required financial endpoints.
• Use short-lived tokens with audience restrictions and prompt revocation support.
• Prevent tokens from appearing in logs, shell traces, error messages, or command output.
• Apply network-level restrictions as defense in depth, but do not treat a private network as a substitute for authenticated encryption.
• Rotate any administrator token that may previously have been transmitted through the documented HTTP endpoint.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:41

Finding

Unauthenticated Integration Endpoints Expose Administrator-Restricted Financial Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29 and 41–56, with the access policy reiterated at lines 91–96
Vulnerability Type: Missing authentication and authorization on sensitive API endpoints
Risk Level: High

Vulnerable Code

The Skill declares all financial access to be administrator-only:

markdown

**ADMIN ONLY.** This skill accesses sensitive financial data. Always use admin-level auth.

However, it documents unauthenticated endpoints that expose financial information:

markdown

## Integration Endpoints (No Auth — if AI access toggle is enabled)

### Cost Summary
GET /api/integration/summary?crop_year=2025

Returns: Total costs by category for the crop year.

### Cash Flow (Simplified)
GET /api/integration/cash-flow-simple?crop_year=2025

Returns: Monthly outflow projections.

### Breakeven Analysis
GET /api/integration/breakeven?crop_year=2025

Returns: Cost per acre and cost per bushel by crop and entity. This tells you the minimum price needed to cover costs.

The stated policy explicitly treats this information as restricted:

markdown

- NEVER share financial data with non-admin users. This includes cost per acre, breakeven, cash flow, or any cost details.

Technical Analysis

The documented integration routes do not authenticate the caller when the AI-access toggle is enabled. A feature toggle controls availability but does not establish identity, verify an administrator role, or enforce authorization for each request.

These routes expose total costs by category, monthly outflow projections, and breakeven figures by crop and entity. That data directly conflicts with the Skill's administrator-only access policy. Client-side sender checks in the Skill cannot protect an API route that independently accepts unauthenticated requests; a caller can bypass the Skill and invoke the API directly.

Exploitability is conditional on the AI-access togg ...[truncated 1174 chars]

Remediation

View remediation

Remediation Suggestions

• Require authentication on every financial endpoint, including all integration routes.
• Enforce administrator authorization server-side for each request rather than relying on Skill instructions or client-side role checks.
• Remove anonymous integration access if it is not strictly necessary.
• If machine-to-machine access is required, use short-lived, narrowly scoped service credentials bound to specific endpoints and audiences.
• Replace the global AI-access toggle with explicit identity-based authorization; a toggle may disable a feature but must not substitute for access control.
• Restrict endpoint reachability through firewall rules or an authenticated gateway as defense in depth.
• Record successful and denied access attempts without logging tokens or sensitive response bodies.
• Add automated authorization tests confirming that anonymous and non-administrator requests receive a denial response for every financial endpoint.
• Review access logs for prior anonymous use whenever the AI-access toggle was enabled.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly documents unauthenticated integration endpoints for highly sensitive financial data, including cost summaries, cash flow projections, and breakeven analysis. Even though other sections say the skill is admin-only, these endpoints bypass that control if the AI access toggle is enabled, creating a direct confidentiality risk and a likely integrity/trust issue because sensitive outputs may be exposed without verifying the requester’s role.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.