Security audit

Wise Read Only

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only Wise API helper with sensitive-account-data risks that are mostly scoped and user-controlled.

Install only if you are comfortable giving the skill a Wise API token for read-only account access. Keep redaction on by default, use --raw only for a specific need, and avoid sharing raw output because it may contain personal or bank-account details.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill requires both environment secret access (WISE_API_TOKEN) and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where a host may grant broader capabilities than intended, increasing the risk of secret exposure or unintended API access if the runner or surrounding environment is misconfigured.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script intentionally supports a --raw mode that bypasses redaction in printJson, which means profile and recipient responses can include PII and bank account details directly in output. In an agent/tooling context, stdout is often surfaced to users, logs, traces, or other downstream systems, so this creates a realistic data exposure path even though the API calls are read-only.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The script reads WISE_API_TOKEN from the environment to authenticate against the Wise API, but there is no user-facing notice, comment, or documentation in this file explaining that a credential will be accessed. Under the rule, access to sensitive environment variables should have some disclosure unless already clearly documented elsewhere.
Content: No source excerpt is available for this finding.