KYC & Identity

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:37 PM UTC
• Version: 1.0.1

Overview

The skill has a legitimate KYC purpose, but it can send identity documents and authenticated requests to a configurable development API destination without enough user confirmation.

Review the configured AIOT_API_BASE_URL before use and only proceed if it points to the intended trusted MasterPay/backend service over HTTPS. Do not use this skill for real identity documents unless you understand where the data is being sent and have confirmed the privacy and retention terms. Treat profile updates, document uploads, and KYC submission as persistent account changes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:16

Finding

Environment-controlled API origin can expose authentication credentials and sensitive KYC data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:8-9, SKILL.md:16-23, SKILL.md:27-36, SKILL.md:69-75
Vulnerability Type: Unrestricted external endpoint configuration for authenticated transmission of sensitive identity data
Risk Level: High

Vulnerable Code

yaml

metadata:
  openclaw:
    requires:
      env:
        - AIOT_API_BASE_URL
    primaryEnv: AIOT_API_BASE_URL

markdown

## Configuration

The default API base URL is `https://payment-api-dev.aiotnetwork.io`. All endpoints are relative to this URL.

To override (e.g. for local development):

```bash
export AIOT_API_BASE_URL="http://localhost:8080"

If AIOT_API_BASE_URL is not set, use https://payment-api-dev.aiotnetwork.io as the base for all requests.

text

The requests directed to this configurable origin include authenticated operations and highly sensitive identity information:

```markdown
- `create_masterpay_user` — Create a MasterPay user account (prerequisite for all MasterPay operations) | `POST /api/v1/masterpay/users` | Requires auth
- `get_kyc_status` — Check current KYC verification status and document upload progress | `GET /api/v1/masterpay/kyc/status` | Requires auth
- `get_kyc_metadata` — Get valid document types, occupations, nationalities, and countries for KYC forms | `GET /api/v1/masterpay/kyc/metadata` | Requires auth
- `submit_kyc` — Submit KYC personal data for review (uses profile data) | `POST /api/v1/masterpay/kyc/submit` | Requires auth
- `upload_kyc_document` — Upload a KYC document (passport, ID, proof of address) via multipart or base64 JSON | `POST /api/v1/masterpay/kyc/documents` | Requires auth
- `submit_wallet_kyc` — Submit wallet-level KYC for a card wallet (requires profile phone number and identity document ID number) | `POST /api/v1/masterpay/wallets/kyc` | Requires auth
- `get_profile` — Get user profile data used for KYC submission | `GET /api/v1/profile` | Requires
...[truncated 3714 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the production API to a trusted HTTPS origin rather than permitting unrestricted runtime replacement.
2. If configuration is operationally necessary, validate the resolved origin against a strict allowlist of approved scheme, hostname, and port combinations.
3. Reject plaintext HTTP for all non-loopback destinations. Permit loopback HTTP only when an explicit development mode is enabled.
4. Separate development and production configurations. Do not use a development service as the default destination for real KYC information.
5. Before transmitting identity documents, display the resolved destination to the user and require explicit confirmation if it is not the canonical production origin.
6. Ensure authorization headers are attached only to approved origins and are removed during redirects to any different origin.
7. Disable cross-origin redirects for authenticated KYC requests or revalidate every redirect target against the allowlist.
8. Use short-lived, audience-restricted bearer tokens with the minimum required API privileges, and provide immediate revocation when endpoint compromise is suspected.
9. Add deployment-time and runtime tests that reject malicious hostnames, user-information URL tricks, nonstandard ports, plaintext remote URLs, and redirect-based origin changes.
10. Document that synthetic data must be used in development and local testing environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to collect and transmit highly sensitive KYC data, including personal profile details and identity documents, but it does not require an explicit user-facing warning or informed consent about privacy, retention, third-party processing, or cross-border transfer to MasterPay. In a KYC context this omission is material because users may provide passports, selfies, addresses, and ID numbers without understanding where the data goes, how it is used, or the risks of disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.