ClawHub
Back to skill

Security audit

SimpleFIN Bank Connection

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent banking-data purpose, but it handles live financial access credentials unsafely and can turn user-provided SimpleFIN URLs or tokens into shell commands.

Review before installing. This skill can read sensitive financial balances and transactions, and its current helper script should be fixed before use: replace shell-based curl calls with a native HTTP client, validate SimpleFIN URLs, avoid plaintext workspace storage, and never print or pass the full Access URL through logs or command-line arguments.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/simplefin_api.js:24
Finding

Arbitrary Command Execution Through an Unsafely Constructed Shell Command

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/simplefin_api.js:24
Finding

Server-Side Request Forgery Through Unrestricted Claim and Access URLs

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:30
Finding

SimpleFIN Access Credentials Exposed Through Output, Process Arguments, and Plaintext Storage

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
node scripts/simplefin_api.js claim "THE_SETUP_TOKEN_HERE"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
node scripts/simplefin_api.js claim "THE_SETUP_TOKEN_HERE"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
node scripts/simplefin_api.js claim "THE_SETUP_TOKEN_HERE"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
node scripts/simplefin_api.js claim "THE_SETUP_TOKEN_HERE"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
node scripts/simplefin_api.js claim "THE_SETUP_TOKEN_HERE"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/developer_guide.md (reported line 7)May include surrounding context.

md
- A user gets a Setup Token from this server.
- The user gives the Setup Token to your application.
- Your application sends the Setup Token to this server and receives an Access Token in return.
- Your application uses the Access Token to get the user's transaction data from this server.
- At any point, the user can disable the Access Token.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/developer_guide.md (reported line 8)May include surrounding context.

md
- A user gets a Setup Token from this server.
- The user gives the Setup Token to your application.
- Your application sends the Setup Token to this server and receives an Access Token in return.
- Your application uses the Access Token to get the user's transaction data from this server.
- At any point, the user can disable the Access Token.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/developer_guide.md (reported line 9)May include surrounding context.

md
- A user gets a Setup Token from this server.
- The user gives the Setup Token to your application.
- Your application sends the Setup Token to this server and receives an Access Token in return.
- Your application uses the Access Token to get the user's transaction data from this server.
- At any point, the user can disable the Access Token.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/developer_guide.md (reported line 16)May include surrounding context.

md
- A user gets a Setup Token from this server.
- The user gives the Setup Token to your application.
- Your application sends the Setup Token to this server and receives an Access Token in return.
- Your application uses the Access Token to get the user's transaction data from this server.
- At any point, the user can disable the Access Token.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/developer_guide.md (reported line 27)May include surrounding context.

You can only do the above step once. Once you receive an ACCESS_URL, save it—the corresponding SETUP_TOKEN will no longer work.

3. Use the Access Token to get some data

Make an HTTP GET request to {ACCESS_URL}/accounts with Basic Auth credentials.

bash

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/developer_guide.md (reported line 43)May include surrounding context.

md
## Limits
The SimpleFIN Bridge is intended to provide daily updates to transaction data. As such, you are expected to make 24 requests or fewer per day. There is a little leeway above this limit, which is helpful when doing initial setup. Quotas are replenished throughout the day.
Requests for all accounts `GET /accounts` have a quota. Requests for individual accounts have their own quota `GET /accounts?account=...`.
Making more requests than expected will eventually cause warning messages to appear in the "errors" array. Exceeding the expected rate limits beyond the warning level will result in Access Tokens being disabled.
The date range of requests to `/accounts` (i.e. difference between start-date and end-date) is limited to 90 days at a time. The number of days of history available varies for each institution.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes shell commands (node scripts/simplefin_api.js ...) but does not declare any explicit tool scope or allowed-tools boundary. That omission weakens least-privilege controls and makes it easier for an agent/runtime to execute broader shell actions than the skill's banking purpose requires.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill tells the agent to search workspace files and environment/config sources for a stored SimpleFIN access URL, which is a credential. Even if related to the skill's function, this introduces secret-discovery behavior and increases the chance of accessing credentials from unintended locations or exposing them during processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill normalizes persistent reuse of a credential-bearing access URL without labeling it as sensitive or warning about handling risks. In the context of bank-account access, this is especially dangerous because compromise of the URL can directly expose balances and transaction history, and possibly require full token reissuance to recover.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs saving a full SimpleFIN Access URL containing embedded username/password credentials into a workspace file for later reuse. Storing live banking credentials in plaintext within shared workspace storage creates a high risk of credential leakage, lateral access by other skills/processes, and unauthorized financial data retrieval.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The claim flow builds a shell command by interpolating a URL derived from an attacker-controlled setup token and executes it with execSync. Even though the URL is wrapped in double quotes, shell metacharacters such as command substitution can still be evaluated, enabling command injection and arbitrary code execution on the host running the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The API fetch path constructs a shell command containing a user-supplied access URL and then executes it via execSync. This creates command-injection risk from crafted URLs and also grants the skill unnecessary subprocess capability in a banking context, increasing the blast radius to arbitrary command execution and possible exposure of financial credentials.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/simplefin_api.js:26