FlowFi

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:49 PM UTC
• Version: 1.0.3

Overview

This is a coherent FlowFi API documentation skill, but it exposes agents to broad account and workflow control with weak guidance around bearer tokens and irreversible actions.

Review this skill before installing if you will let an agent act on your FlowFi account. Use short-lived, narrowly scoped tokens where possible, avoid placing JWTs in WebSocket URLs or logs, and require explicit confirmation before deploy, start, edit, cancel, stop, or delete operations, especially workflows that can trigger transactions or public notifications.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: docs/websocket.md:3

Finding

Bearer JWT Exposure Through WebSocket Query-String Authentication

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

md

| **Pause running** | `POST /workflows/:id/pause`. Resume with `POST /workflows/:id/resume`. |
| **Stop and make editable** | `POST /workflows/:id/undeploy` — status goes back to **draft**. |
| **End the workflow** | `POST /workflows/:id/stop` — status **ended**; no more runs (you can deploy again later). |
| **Remove permanently** | **Delete** — `DELETE /workflows/:id`. Safe for any status; backend stops the scheduler if needed. |
| **List workflows** | `GET /workflows` with optional `?status=draft`, `?smartAccountId=...`, pagination. |
| **Run once / watch runs** | **Start run** — `POST /executions/workflows/:workflowId/start`. **List runs** — `GET /executions` or `GET /executions/workflows/:workflowId`. **Real-time** — WebSocket namespace `/workflow-status`; subscribe to `execution` or `workflow` for live status and history refresh. |
| **Start from a template** | **List** — `GET /templates` or `GET /templates/categories`. **Clone** — `POST /templates/:id/clone` with `smartAccountId` (and optional `name`, `network`) to create a **draft** workflow; then edit and deploy. |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/workflows.md (reported line 36)May include surrounding context.

md

| **Pause running** | `POST /workflows/:id/pause`. Resume with `POST /workflows/:id/resume`. |
| **Stop and make editable** | `POST /workflows/:id/undeploy` — status goes back to **draft**. |
| **End the workflow** | `POST /workflows/:id/stop` — status **ended**; no more runs (you can deploy again later). |
| **Remove permanently** | **Delete** — `DELETE /workflows/:id`. Safe for any status; backend stops the scheduler if needed. |
| **List workflows** | `GET /workflows` with optional `?status=draft`, `?smartAccountId=...`, pagination. |
| **Run once / watch runs** | **Start run** — `POST /executions/workflows/:workflowId/start`. **List runs** — `GET /executions` or `GET /executions/workflows/:workflowId`. **Real-time** — WebSocket namespace `/workflow-status`; subscribe to `execution` or `workflow` for live status and history refresh. |
| **Start from a template** | **List** — `GET /templates` or `GET /templates/categories`. **Clone** — `POST /templates/:id/clone` with `smartAccountId` (and optional `name`, `network`) to create a **draft** workflow; then edit and deploy. |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/workflows.md (reported line 50)May include surrounding context.

md

- **Undeploy** — `POST /workflows/:id/undeploy` → back to **draft** so you can edit.
- **Pause / Resume** — `POST /workflows/:id/pause`, `POST /workflows/:id/resume` (active ↔ paused).
- **Stop** — `POST /workflows/:id/stop` → **ended** (no more runs; can deploy again later).
- **Delete** — `DELETE /workflows/:id` removes the workflow permanently (any status).
- **List workflows** — `GET /workflows` with optional `?status=draft`, `?smartAccountId=...`, pagination.
- **Price** — `GET /price?symbol=BNB` (one token USD price, no auth); `GET /price/prices` (BNB + ETH, no auth).
- **Templates** — `GET /templates` (list, no auth), `GET /templates/display`, `GET /templates/categories`, `GET /templates/:id` (full); `POST /templates/:id/clone` (JWT) creates a draft workflow.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill tells users to send a JWT to OpenClaw and says it will be reused for all API requests, but it provides no warning that bearer tokens are highly sensitive credentials equivalent to account access. In an agent context, this increases the risk of accidental token disclosure, unsafe logging, reuse across sessions, or transmission to unintended tools/services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README describes deploy, undeploy, pause, resume, stop, and delete operations, including that deployment activates triggers and deletion is permanent, but it does not provide an explicit cautionary warning section about the potential operational impact on live workflows or downstream actions. For markdown files, safety-relevant behaviors that can affect user systems or data should be accompanied by clear warnings, especially for irreversible or live-execution actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown documents DELETE /workflows/:id as permanently removing a workflow and its variables, but it does not include a prominent caution or user warning about irreversible data loss beyond the endpoint description itself. For markdown files, destructive behaviors that affect user data should be accompanied by clear warnings about impact on data and recovery.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.