Security audit

Skill Openclaw

Security checks across malware telemetry and agentic risk

Overview

This is a coherent payments skill, but it gives an agent durable authority to move money and exposes sensitive financial details without enough local confirmation or redaction controls.

Install only if you intentionally want an agent to spend or move funds through Oris. Set very low spending limits, keep limited wallet balances, require human approval in your host workflow for pay/order/off-ramp/approve tools, protect ~/.openclaw/config.json, rotate Oris credentials if exposed, and avoid entering bank details unless argument logging is disabled or redacted.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The server reads Oris credentials from a local OpenClaw config file when environment variables are absent, which expands its credential access scope beyond what a payment tool strictly needs at runtime. In an agent-skill context, implicit local file credential discovery is risky because it enables unattended use of stored secrets without an explicit user consent step or clear disclosure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill advertises capabilities to send payments, place orders, fund via bank transfer or card, and withdraw to bank accounts, but it does not present an explicit warning that these actions can move real money or incur irreversible financial consequences. In this context, the missing warning is more dangerous than usual because the entire skill is designed for autonomous spending, so users may enable it without appreciating that agent actions can directly trigger real-world fund movement.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The declaration explicitly states that Oris credentials are written to OpenClaw's shared config store, including API key and API secret, but there is no indication of an explicit consent prompt, secure-storage guarantee, or minimization of secrets at the operation point. Persisting live payment credentials in a shared plaintext-style config location increases the risk of credential theft by other local processes, users, or skills if file permissions or downstream handling are weak.

Missing User Warnings

High

Confidence: 91% confidence
Finding: The setup flow includes creation of a blockchain wallet and assignment of a default spending policy, which are security- and financially-sensitive actions, yet the interface documentation shows no explicit warning, review step, or confirmation gate. In a payments skill, silent provisioning of spend-capable infrastructure can cause unintended fund movement capability or policy misconfiguration, especially if triggered by an agent on behalf of a user.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The setup flow persists the API key and API secret directly into ~/.openclaw/config.json, creating a local plaintext secret store. Even though the code sets restrictive file modes, local filesystem compromise, backups, developer tooling, or accidental disclosure can expose credentials that authorize wallet/payment actions, which is especially sensitive in a payment skill.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The setup routine performs live external actions—agent registration, wallet creation, and spending policy configuration—immediately after receiving credentials, with no visible confirmation, dry-run, or user-facing disclosure in this code. In a financial skill, implicit network-side provisioning is risky because invoking setup can create real accounts/resources and alter payment posture without clear operator awareness.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The setup flow persists the Oris API key and API secret in a local JSON config file under the user's home directory. Although restrictive file modes are requested, local plaintext storage of payment credentials materially increases the chance of credential theft by other local processes, backups, misconfigured permissions, or accidental disclosure, and this code provides no user-facing warning or safer storage option.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The setup routine immediately performs external API calls to register an agent, create a wallet, and set an enforcement policy once credentials are supplied, but this file contains no explicit disclosure or confirmation that network operations and account-modifying actions will occur. In a spending/payment skill, silent remote provisioning is security-relevant because it can create financial accounts and policies without the user's informed approval.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The payment tool can directly initiate fund transfers from agent-provided arguments with no local confirmation, policy check, recipient validation, or amount sanity check visible in this executor. In an agent context, that makes prompt-injection, tool misuse, or accidental invocation much more dangerous because the action is irreversible and financial.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The fiat offramp operation sends destination account details and withdrawal instructions directly from tool arguments without any visible confirmation or redaction controls in this file. In a financial agent, this raises the risk of unauthorized withdrawals, misdirection of funds, and exposure of sensitive banking details if the tool is triggered by manipulated or mistaken input.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code accesses a local config file containing credentials without an adjacent warning or explicit disclosure to the user. In a skill that can trigger financial actions, silent local secret loading reduces user awareness and increases the chance that a hosted or delegated agent will operate with sensitive payment credentials unexpectedly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The server logs tool-call arguments, which may include payment details, recipient information, policy data, or other sensitive operational inputs. Even though the log truncates to 200 characters, partial secrets or transaction data can still be exposed to stderr logs, aggregators, or host-level monitoring systems.

Session Persistence

Medium

Category: Rogue Agent
Content: * 2. Validate API key format (oris_sk_live_ prefix, min length) * 3. Validate API secret format (oris_ss_live_ prefix, min length) * 4. Register agent via SDK * 5. Create ERC-4337 wallet on Base * 6. Set default spending policy * 7. Write all credentials to OpenClaw config store */
Confidence: 74% confidence
Finding: Create ERC-4337 wallet on Base * 6. Set default spending policy * 7. Write all credentials to OpenClaw config store */ interface SetupInput { apiKey: string; apiSecret: string; } interf

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.