Finance Automation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:54 AM UTC
• Version: 0.2.1

Overview

The skill matches its finance-automation purpose, but it exposes sensitive financial read/write APIs without implemented authentication or authorization.

Review before installing or deploying. Use only test data until authentication and role-based authorization are added, do not expose the server or ngrok tunnel beyond the webhook path, protect and rotate .env secrets, restrict Telegram/OpenClaw notifications to non-sensitive details, and verify retention/encryption for stored invoices, receipts, logs, and financial records.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/index.js:68

Finding

Unauthenticated Access to Sensitive Financial APIs

Content

View full analysis

{ try { const invoice = await invoiceService.updateInvoice(req.params.id, req.body); res.json(invoice); } catch (error) { next(error); } }); // DELETE /api/invoices/:id - Delete invoice (draft only) router.delete('/:id', async (req, res, next) => { try { const result = await invoiceService.deleteInvoice(req.params.id); res.json(result); } catch (error) { next(error); } }); // POST /api/invoices/:id/send - Send invoice router.post('/:id/send', async (req, res, next) => { try { const invoice = await invoiceServ ...[truncated 5202 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/config/config.js:28

Finding

Predictable Fallback JWT Signing Secret

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (74)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · ARCHITECTURE.md (reported line 209)May include surrounding context.

md

POST   /api/expenses              # 경비 추가
GET    /api/expenses/:id          # 경비 상세
PUT    /api/expenses/:id          # 경비 수정
DELETE /api/expenses/:id          # 경비 삭제
POST   /api/expenses/:id/approve  # 경비 승인

# Reports

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · QUICKSTART.md (reported line 21)May include surrounding context.

bash

# .env 파일 생성
cp .env.example .env

# 에디터로 열기
code .env  # 또는 nano .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 120)May include surrounding context.

bash

# .env 파일 생성
cp .env.example .env

# 에디터로 열기
code .env  # 또는 nano .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 68% confidence

Finding

Using docker run --env-file .env can expose a highly sensitive file containing payment processor keys, SMTP credentials, bot tokens, and webhook secrets to operators, logs, or insecure local handling if users copy this pattern into shared or production environments. In the context of a finance automation skill, compromise of these secrets could enable fraudulent API use, invoice abuse, notification hijacking, and access to financial workflows.

Content

Scanner excerpt · README.md (reported line 355)May include surrounding context.

bash

docker build -t finance-automation .
docker run -p 3000:3000 --env-file .env finance-automation

보안 체크리스트

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · QUICKSTART.md (reported line 20)May include surrounding context.

Quick Start

bash

cd finance-automation
cp .env.example .env
# Edit .env with your API keys
npm install
npm run db:init

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · QUICKSTART.md (reported line 24)May include surrounding context.

Quick Start

bash

cd finance-automation
cp .env.example .env
# Edit .env with your API keys
npm install
npm run db:init

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Quick Start

bash

cd finance-automation
cp .env.example .env
# Edit .env with your API keys
npm install
npm run db:init

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Quick Start

bash

cd finance-automation
cp .env.example .env
# Edit .env with your API keys
npm install
npm run db:init

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-db.js (reported line 67)May include surrounding context.

js

}
    console.log('\n🎉 Database initialization complete!');
    console.log('\nNext steps:');
    console.log('1. Copy .env.example to .env');
    console.log('2. Fill in your API keys');
    console.log('3. Run: npm run dev');
  });

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The DELETE /api/expenses/:id route forwards a user-controlled ID directly to a destructive service operation with no visible authentication, authorization, or ownership checks in the route layer. In an expense-management context, this can enable insecure direct object reference or unauthorized deletion of business records if the service layer does not strictly enforce access control.

Content

Scanner excerpt · src/api/expenses.js (reported line 50)May include surrounding context.

js

}
});

// DELETE /api/expenses/:id - Delete expense (pending only)
router.delete('/:id', async (req, res, next) => {
  try {
    const result = await expenseService.deleteExpense(req.params.id);

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · ARCHITECTURE.md (reported line 200)May include surrounding context.

md

}
});

// DELETE /api/invoices/:id - Delete invoice (draft only)
router.delete('/:id', async (req, res, next) => {
  try {
    const result = await invoiceService.deleteInvoice(req.params.id);

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · src/api/invoices.js (reported line 50)May include surrounding context.

js

}
});

// DELETE /api/invoices/:id - Delete invoice (draft only)
router.delete('/:id', async (req, res, next) => {
  try {
    const result = await invoiceService.deleteInvoice(req.params.id);

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The payment, invoice, and expense flows all route notifications to Telegram, an external service, which can expose operational or financial metadata outside the primary system. The markdown lacks any warning that such notifications may share sensitive business or customer-related information with a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents that invoice generation produces a PDF file and the schema includes a persisted pdf_path, which affects user/customer data handling. Under the markdown-file criteria for SQP-2, the description should warn that customer invoice documents are generated and stored, but no such warning is present nearby or elsewhere in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The event flow explicitly says the Email Service sends invoices to customers, which implies transmission of customer contact and billing data. For markdown files, SQP-2 requires warnings when behavior may affect user data or privacy, and this file provides no warning or disclosure about that external transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The quick start instructs users to place sensitive bot credentials directly into a local .env file and later test the integration, but it does not include explicit guidance on protecting those secrets. In practice, this increases the risk of accidental exposure through screenshots, shell history, logs, commits, or shared development environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The guide recommends forwarding local webhook traffic through Stripe CLI or ngrok without warning that request payloads and metadata may transit third-party infrastructure or expose a local development service to the internet. If developers use real customer or payment data, this can create unnecessary data exposure and broaden the attack surface.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · QUICKSTART.md (reported line 173)May include surrounding context.

bash

# Bot token 테스트
curl "https://api.telegram.org/bot<YOUR_BOT_TOKEN>/getMe"

# Chat ID 확인
curl "https://api.telegram.org/bot<YOUR_BOT_TOKEN>/getUpdates"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · QUICKSTART.md (reported line 176)May include surrounding context.

bash

# Bot token 테스트
curl "https://api.telegram.org/bot<YOUR_BOT_TOKEN>/getMe"

# Chat ID 확인
curl "https://api.telegram.org/bot<YOUR_BOT_TOKEN>/getUpdates"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document is written in Korean and presents the skill as 'OpenClaw용 금융/결제 자동화 스킬' without indicating that language is configurable or that the locale is intentionally restricted to Korean users. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This skill is explicitly designed to process invoices, payments, receipts, OCR output, email delivery, and Telegram notifications, all of which can contain financial and personal data. The README lacks a clear warning about transmitting regulated or sensitive data to third-party services, increasing the chance of unsafe deployment, over-collection, or accidental disclosure.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · README.md (reported line 141)May include surrounding context.

md

# Server
PORT=3000
NODE_ENV=development

# OpenClaw (선택)
OPENCLAW_API_URL=http://localhost:7777

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill describes handling payments, invoices, expenses, and Telegram notifications but does not warn about the sensitivity of financial data or the risks of transmitting such data to third-party services. In a finance-focused skill, this omission can lead operators to expose customer payment, invoice, or expense information without appropriate controls or data-minimization practices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This SQL file contains a natural-language locale/business-policy choice embedded in schema defaults by forcing 'KRW' for payments. The policy criteria require flagging locale-related constraints when they are imposed without opt-in or clear justification, and no such justification appears in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.