OATDA Check Balance

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 1.0.0

Overview

This skill checks an OATDA balance using a clearly disclosed OATDA API key and does not show hidden, destructive, or persistent behavior.

Install only if you intend the agent to check your OATDA account balance. Prefer providing OATDA_API_KEY through your normal secret mechanism; if using ~/.oatda/credentials.json, understand the skill tells the agent how to read that specific local credential and use it with OATDA's API.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

"openclaw":
      {
        "emoji": "💳",
        "requires": { "bins": ["curl", "jq"], "env": ["OATDA_API_KEY"], "config": ["~/.oatda/credentials.json"] },
        "primaryEnv": "OATDA_API_KEY",
      },
  }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The skill instructs the agent to read an API key directly from ~/.oatda/credentials.json and export it into the shell environment automatically. Even though the apparent purpose is legitimate, automatic secret harvesting from local files expands credential exposure and normalizes a pattern where a skill can access sensitive local configuration without explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

All commands need the OATDA API key. Resolve it inline for each exec call:

bash

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}"

If the key is empty or null, tell the user to get one at https://oatda.com and configure it.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This command both reads the API key from a local credential file and immediately uses it in an outbound Authorization header. While the destination appears to be the vendor API, the risky behavior is that the skill autonomously retrieves a local secret and transmits it over the network, which can be abused if the skill content, endpoint, or execution context is later modified or spoofed.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

API Call

bash

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}" && \
curl -s -X GET "https://oatda.com/api/v1/user/credits" \
  -H "Authorization: Bearer $OATDA_API_KEY"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The example repeats the same credential-access pattern, reinforcing automatic retrieval of a local API key and network use of that secret. Repetition increases the chance implementers will copy the insecure pattern broadly, making credential access a baked-in behavior of the skill rather than an explicitly authorized platform capability.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

User: "Do I have enough credits for a 10-second video?"

bash

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}" && \
curl -s -X GET "https://oatda.com/api/v1/user/credits" \
  -H "Authorization: Bearer $OATDA_API_KEY"

Static analysis

No suspicious patterns detected.