Skill Openclaw

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:45 AM UTC
• Version: 1.0.4

Overview

This is a clearly payment-oriented skill, but it deserves Review because it combines real fund-transfer authority with raw sensitive argument logging, persistent payment credentials, and an unbounded production SDK dependency used during credentialed setup.

Review this carefully before installing in any account that can move real funds. Use only low spending limits, rotate/revoke Oris credentials if logs or the config file may have been exposed, avoid untrusted launch environments that can set ORIS_BASE_URL, and prefer a release that pins oris-sdk, redacts financial logs, validates endpoints, initializes the usage gate correctly, and adds explicit human confirmation for transfers, withdrawals, fiat funding, and marketplace purchases.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: package.json:27

Finding

Unbounded Production Dependency Allows Unreviewed Supply-Chain Code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: oris_mcp/server.py:183

Finding

Sensitive Financial Tool Arguments Are Written to Application Logs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: oris_mcp/server.py:85

Finding

Unvalidated API Base URL Can Redirect Credentials and Financial Requests

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: oris_mcp/server.py:116

Finding

Unreachable Initialization Leaves the Usage Gate Undefined and Terminates Tool Handling

Content

View full analysis

dict[str, Any]: """Read Oris credentials from OpenClaw's native config store.""" config_path = os.path.join( os.environ.get("HOME", os.environ.get("USERPROFILE", "~")), ".openclaw", "config.json", ) try: with open(config_path) as f: data = json.load(f) return data.get("oris", {}) except (FileNotFoundError, json.JSONDecodeError): return {} self._initialized = False self._usage_gate = UsageGate(self._executor) ``` The undefined attribute is later used during every valid tool call: ```python block_error, usage_snapshot = await self._usage_gate.check(tool_name) ``` ### Technical Analysis Both branches of `_read_openclaw_config` return before `_initialized` and `_usage_gate` are assigned. Additionally, the method is static and has no `self` parameter. Consequently, those statements can never initialize the server instance. `OrisMcpServer.__init__` does not initialize `_usage_gate` elsewhere. When `_handle_tools_call` receives any valid tool name, accessing `self._usage_gate` raises `AttributeError`. The exception is not converted into a JSON-RPC error by `_handle_tools_call`. It reaches `StdioTransport.start`, whose broad exception handler logs the error and breaks the input loop. This also means the advertised fail-closed usage-limit control does not execute as designed. In the reviewed stdio flow, the defect prevents the financial action rather than bypassing the gate, but it makes the payment service unavailable. ### Attack Path 1. A client completes or skips initialization and sends a syntactically valid `tools/call` request using any registered tool name. 2. `_handle_tools_call` verifies that the ...[truncated 772 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Undeclared zero-knowledge proof generation and cryptographic proof handling are not inherently malicious, but they are security-sensitive and materially different from a simple payment skill. When advanced cryptographic functionality is bundled without clear disclosure, operators cannot properly assess native-module risk, compute/resource impact, or whether proofs are being used in ways unrelated to the advertised payment workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Undeclared zero-knowledge proof generation and cryptographic proof handling are not inherently malicious, but they are security-sensitive and materially different from a simple payment skill. When advanced cryptographic functionality is bundled without clear disclosure, operators cannot properly assess native-module risk, compute/resource impact, or whether proofs are being used in ways unrelated to the advertised payment workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Undeclared zero-knowledge proof generation and cryptographic proof handling are not inherently malicious, but they are security-sensitive and materially different from a simple payment skill. When advanced cryptographic functionality is bundled without clear disclosure, operators cannot properly assess native-module risk, compute/resource impact, or whether proofs are being used in ways unrelated to the advertised payment workflow.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares environment-variable and networked MCP capabilities but does not declare any explicit tool scope or permissions boundary. For a payments skill handling API credentials and transaction-capable operations, missing scope declarations increases the risk of overbroad access and makes it harder for operators to audit or constrain what the skill may do.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The setup flow creates a wallet, sets a default spending policy, and persists the resulting credentials for future reuse, which establishes durable financial capabilities beyond a single session. In the context of a spending/payment skill, persistent wallet and API access is especially sensitive because compromise of the stored configuration could enable unauthorized payments or policy changes over time.

Content

Scanner excerpt · dist/index.d.ts (reported line 9)May include surrounding context.

ts

*   2. Validate API key format (oris_sk_live_ prefix, min length)
 *   3. Validate API secret format (oris_ss_live_ prefix, min length)
 *   4. Register agent via SDK
 *   5. Create ERC-4337 wallet on Base
 *   6. Set default spending policy
 *   7. Write all credentials to OpenClaw config store
 */

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The declarations explicitly state that API keys, API secrets, agent IDs, and wallet information are written into a shared OpenClaw config store at ~/.openclaw/config.json, and that the MCP server later reads them as environment variables. Storing payment and wallet credentials in a shared plaintext-style config location without any disclosure, scoping, encryption, or permission-hardening guidance materially increases the risk of credential theft by other local processes, users, or skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup flow persists the API key and API secret to ~/.openclaw/config.json, creating a local plaintext secret store. Although the file is created with restrictive permissions, storing long-lived payment credentials on disk increases the risk of credential theft from local compromise, backups, sync tools, or other processes reading the file. In a payments skill, those credentials may enable wallet operations and spending actions, so the context makes this more sensitive than ordinary application settings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup flow persists the Oris API key and API secret to ~/.openclaw/config.json, creating a local plaintext credential store. Even though restrictive file modes are requested, local secrets at rest remain exposed to compromise from local malware, backups, accidental disclosure, or other processes/users in misconfigured environments, and this skill manages payment-capable credentials, which raises the risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code accesses ORIS_API_KEY, ORIS_API_SECRET, ORIS_AGENT_ID, and falls back to reading credentials from ~/.openclaw/config.json. Although the module docstring documents configuration, there is no user-facing warning or disclosure at the point of access that the server will automatically consume locally stored secrets, which is a safety-relevant credential access behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Tool-call arguments are forwarded to the executor for payment operations against an external Oris service without any explicit user-facing disclosure or consent check in the request path. In an agent setting, this can cause sensitive financial, identity, or transaction metadata supplied by users or upstream tools to be sent off-box unexpectedly, increasing privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The tool definition exposes a payment-sending capability but does not require any explicit user confirmation, warning text, or acknowledgement that invoking it can irreversibly transfer funds. In an agentic context, a model may select this tool based on prompt injection, misunderstanding, or ambiguous user intent, causing unauthorized or unintended financial loss even if downstream compliance checks exist.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This on-ramp tool can initiate external payment actions such as bank transfers or card charges, but the interface does not prominently warn that real-world payment rails may be triggered. In an autonomous agent setting, lack of explicit confirmation increases the risk of accidental funding events, chargeable transactions, or abuse through manipulated prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The off-ramp tool enables withdrawal of stablecoins to a bank account, which is a sensitive fund-transfer operation, yet the tool contract lacks an explicit warning or confirmation field. Because withdrawals may be hard to reverse and destination_account is a free-form string, an agent could send funds to the wrong account or be induced to exfiltrate assets.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a spending/payments skill with built-in policy and compliance, but this file also implements local credential discovery by reading ~/.openclaw/config.json when environment variables are absent. Accessing arbitrary local config files is not clearly implied by the stated purpose and expands the skill's capability beyond simply exposing payment tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Although the description mentions escrow-backed purchase, the tool still commits funds and creates a financial obligation without an explicit acknowledgement or confirmation requirement in the schema. In a marketplace context, an agent could place unintended orders or lock funds in escrow due to ambiguous prompts or malicious instruction injection.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The runtime dependency oris-sdk is specified as *, which allows installation of any published version, including future releases with breaking changes or maliciously introduced supply-chain compromises. In a payment-related agent skill, this is more dangerous than usual because the dependency likely mediates payment, wallet, or compliance logic, so a compromised update could directly affect fund movement or sensitive financial operations.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json

"typecheck": "tsc --noEmit"
  },
  "dependencies": {
    "oris-sdk": "*"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json

"oris-sdk": "*"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",
    "tsup": "^8.0.0",
    "typescript": "^5.5.0",
    "vitest": "^2.0.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json

},
  "devDependencies": {
    "@types/node": "^22.0.0",
    "tsup": "^8.0.0",
    "typescript": "^5.5.0",
    "vitest": "^2.0.0"
  },

Unverifiable Dependency: tsup has 1 known advisory(ies) (CVE-2024-53384 (tsup DOM Clobbering vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 34)May include surrounding context.

json

"devDependencies": {
    "@types/node": "^22.0.0",
    "tsup": "^8.0.0",
    "typescript": "^5.5.0",
    "vitest": "^2.0.0"
  },
  "keywords": [

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 35)May include surrounding context.

json

"@types/node": "^22.0.0",
    "tsup": "^8.0.0",
    "typescript": "^5.5.0",
    "vitest": "^2.0.0"
  },
  "keywords": [
    "oris",

Unverifiable Dependency: vitest has 3 known advisory(ies) (CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock); CVE-2025-24964 (Vitest allows Remote Code Execution when accessing a malicious website while Vit)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

pydantic>=2.0,<3 permits a broad range of versions, and the package has had multiple advisories across its lifecycle. Because this is an MCP server for agent payment tooling, input validation is security-relevant; an affected resolved version could enable denial of service or malformed-input handling issues in externally reachable interfaces.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: grpcio has 11 known advisory(ies) (CVE-2023-33953 (Excessive Iteration in gRPC); CVE-2023-1428 (gRPC Reachable Assertion issue); CVE-2023-32732 (gRPC connection termination issue) +8 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 76% confidence

Finding

The optional grpcio dependency is only range-constrained (>=1.60,<2) and has a history of multiple security advisories. Although optional, if the gRPC transport is enabled in this payment-related agent service, a vulnerable resolved version could expose network-facing denial-of-service or protocol-handling weaknesses.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.