Farmos Land Portfolio

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:10 PM UTC
• Version: 1.0.0

Overview

This skill matches its farming finance purpose, but it handles sensitive landlord and payment data through weakly scoped access and cleartext API/token instructions.

Review before installing. This skill is for a sensitive business system and should only be used where the FarmOS API is protected by real server-side authentication, TLS, least-privilege tokens, and explicit confirmation for bulk or year-end changes. Do not rely on the local role file as the only access boundary.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:39
• Finding: Unauthenticated Endpoints Expose Restricted Landlord and Financial Records<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–82 **Vulnerability Type**: Missing server-side authentication and authorization **Risk Level**: High ### Vulnerable Code ```markdown ## Access Control Lease terms, rent amounts, and landlord info are sensitive business data. Restrict to admin or manager roles only. **Role mapping:** Check the sender's role in `~/.openclaw/farmos-users.json`. If the user is not admin or manager, tell them they don't have access to land portfolio data. ## API Base http://100.102.77.110:8009 ## Integration Endpoints (No Auth Required) — READ OPERATIONS ONLY **IMPORTANT: Use auth endpoints for WRITE operations (mark-paid, renewals). Use integration `/all` endpoints for READ operations (listing payments, leases, landlords).** ### Payments (FULL — use this, not dashboard) GET /api/integration/payments/all - Returns ALL payments with full details — parcel names, landlord names, overdue status ### Leases (FULL) GET /api/integration/leases/all - Returns ALL leases with landlord contact info, rent terms, expiration status ### Landlords (FULL) GET /api/integration/landlords/all - Returns ALL landlords with contact info, active lease count, total acres, total rent ``` ### Technical Analysis The Skill explicitly classifies lease terms, rent amounts, landlord information, and payment records as sensitive and restricted to administrators or managers. Nevertheless, it directs clients to read those records from endpoints requiring no authentication. Checking the sender's role in `~/.openclaw/farmos-users.json` is only an agent-side policy check. It is not an effective authorization boundary because a caller with network access can bypass the agent and request the integration endpoints directly. The server therefore cannot establish the caller's identity or verify that the caller has an authorized role. ### Attack Path 1. An attacker obtains network reachability to `100.102.77.110:8009`. 2. The attacker sen ...[truncated 1080 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require authentication for every endpoint returning lease, landlord, payment, parcel, or financial information. 2. Enforce admin-or-manager authorization on the server for each request; do not rely on the agent or local role-mapping file as the security boundary. 3. Apply deny-by-default access control and return `401 Unauthorized` for missing or invalid credentials and `403 Forbidden` for insufficient roles. 4. Use narrowly scoped claims such as `land-portfolio:read` rather than relying solely on broad role names. 5. Validate token issuer, audience, expiration, signature, and required scopes server-side. 6. Minimize returned fields according to the caller's authorization and business need. 7. Add audit logging for access to landlord contact details and financial records. 8. Add automated tests proving that anonymous and unauthorized requests cannot access any sensitive integration endpoint. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:127
• Finding: Bearer Tokens and Sensitive API Data Are Transmitted over Cleartext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 127–130 **Vulnerability Type**: Unencrypted transmission of credentials and sensitive data **Risk Level**: High ### Vulnerable Code ```markdown **To use the token:** Include it as a Bearer token: ```bash curl -H "Authorization: Bearer $TOKEN" http://100.102.77.110:8009/api/endpoint ``` ``` The configured API base is also explicitly defined at lines 43–45: ```markdown ## API Base http://100.102.77.110:8009 ``` ### Technical Analysis The documentation directs clients to transmit JWT bearer tokens and sensitive API responses over plain HTTP. HTTP does not provide transport confidentiality, integrity, or server authentication. A private or overlay-network address does not replace TLS. Any party able to observe or manipulate traffic along the route may capture bearer credentials, inspect sensitive records, alter requests, or modify responses. Because a bearer token grants access to whoever possesses it, interception can permit authenticated replay until the token expires. ### Attack Path 1. An administrator or manager obtains a JWT using the documented authentication helper. 2. The client sends the JWT in the `Authorization` header to an `http://` endpoint. 3. An attacker with visibility or control over the network path captures the unencrypted request. 4. The attacker extracts the bearer token and replays it before its 15-minute expiration. 5. Depending on the token's privileges, the attacker invokes authenticated payment or lease-management endpoints. 6. Alternatively, the attacker modifies requests or responses in transit, potentially changing payment dates, notes, lease values, or the records displayed to the user. ### Impact Assessment A successful interception can disclose: - JWT bearer credentials - Landlord contact information - Lease and rent terms - Payment and financial records - Parcel and acreage information If an intercepted token has write privileges, the attacker may ...[truncated 210 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every `http://` API URL with `https://`. 2. Configure TLS with a certificate trusted by all authorized clients and require certificate validation. 3. Redirecting HTTP to HTTPS is insufficient for credentials; reject credential-bearing HTTP requests entirely. 4. Use HSTS where the deployment model supports it. 5. Issue short-lived, audience-bound, narrowly scoped tokens and rotate signing keys according to a documented policy. 6. Never place bearer tokens in URLs, logs, command traces, or error messages. 7. Consider mutual TLS or another device-authentication control for access across an internal or overlay network. 8. Monitor for token replay and revoke tokens after suspected interception. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:121
• Finding: Authentication Example Encourages Acquisition of an Overprivileged Administrator Token<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 121–130 **Vulnerability Type**: Violation of least privilege **Risk Level**: Medium ### Vulnerable Code ```markdown ### Authentication This skill accesses protected FarmOS endpoints that require a JWT token. **To get a token:** Run the auth helper with the appropriate role: ```bash TOKEN=$(~/clawd/scripts/farmos-auth.sh admin) ``` **To use the token:** Include it as a Bearer token: ```bash curl -H "Authorization: Bearer $TOKEN" http://100.102.77.110:8009/api/endpoint ``` ``` ### Technical Analysis The Skill permits both administrators and managers to perform land-portfolio operations, but its only executable authentication example requests an `admin` token. This contradicts the statement that the helper should use the appropriate role and encourages callers to obtain broader privileges than the documented task requires. If the helper issues an administrator credential without independently verifying the caller's authorization, a manager-level session, compromised agent, or injected instruction could obtain administrator privileges. Even when the helper does verify authorization, using a broad administrator token for routine payment and lease operations unnecessarily increases the impact of token theft or misuse. ### Attack Path 1. A manager or a compromised manager-level agent initiates an authenticated land-portfolio workflow. 2. The workflow follows the documented command and invokes `farmos-auth.sh admin`. 3. If the helper does not independently prevent the elevation, it returns an administrator JWT. 4. The caller uses the token for operations beyond the manager's intended privileges. 5. Even if only documented FarmOS endpoints are used, theft or misuse of the broad token can affect multiple payments, leases, or annual schedules. This privilege-escalation path depends on the authentication helper accepting the requested `admin` role. The helper was not included in the reviewed ...[truncated 727 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the hardcoded `admin` example with a token request derived from the already verified sender identity and role. 2. Do not allow callers to select a role merely by passing an untrusted command-line argument. 3. Have the authentication helper independently authenticate the caller and cap issued privileges at the caller's assigned role. 4. Prefer operation-specific scopes such as: - `payments:mark-paid` - `leases:preview-renewal` - `leases:renew` - `payments:rollover` 5. Separate read, preview, and execute permissions. 6. Require stronger confirmation or approval for bulk renewal and year-end rollover execution. 7. Enforce authorization again at every API endpoint rather than trusting the token-acquisition workflow alone. 8. Add tests proving that managers cannot obtain administrator tokens and that task-scoped tokens cannot invoke unrelated administrator operations. ]]>

SkillSpector

Vulnerability Patterns

• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: farmos-land-portfolio
description: Query land ownership, leases, landlord info, and land payments. Write operations for payment management and lease renewals.
tags: [farming, land, leases, landlords]
---

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest understates the skill's write capabilities by mentioning only payment management and lease renewals, while the body also documents year-end rollover execution that creates future payment records. This mismatch can cause users or policy systems to underestimate the operational scope and approve a more powerful skill than intended.

Unbounded Output

Medium

• Category: Output Handling

Content

### Upcoming Payments (next N days)
GET /api/integration/payments/upcoming?days=30
- Returns ALL upcoming payments within N days (no truncation)
- Use `days=60` or `days=90` for longer lookahead

### Leases (FULL)

• Confidence: 81% confidence
• Finding: The skill explicitly favors endpoints that return all matching records with no truncation, which can produce very large responses. In an agent workflow, unbounded output can exhaust context windows, degrade reliability, and increase exposure of sensitive financial and landlord data beyond what is necessary for the user's request.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill exposes single and bulk state-changing operations such as marking payments paid and renewing leases, but it does not require an explicit user-facing warning that these actions modify business records. In an agent setting, insufficient confirmation language increases the risk of accidental or misunderstood destructive changes at scale.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Year-end rollover execution can create next year's payment schedules and materially affect future financial records, but the documentation does not clearly warn about the scope and persistence of those changes. Because this operation creates new records rather than simply updating existing ones, accidental execution could cause widespread accounting and planning errors.

Description-Behavior Mismatch

Low

• Confidence: 94% confidence
• Finding: The manifest understates the skill's write capabilities by mentioning only payment management and lease renewals, while the body also documents year-end rollover execution that creates future payment records. This mismatch can cause users or policy systems to underestimate the operational scope and approve a more powerful skill than intended.

Static analysis

No suspicious patterns detected.