Security audit

Pay Bills

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its bill-payment purpose, but it stores and prints account session tokens in plaintext while enabling authenticated wallet purchases.

Review carefully before installing. Only use this in a private workspace, avoid pasting OTPs, PINs, or tokens into places that may be logged, clear the saved session after use, and prefer a version that redacts tokens and stores credentials in a protected secret store rather than .session_token.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: session-token.js:14
Finding: Plaintext Session Token Storage and Disclosure Through CLI Arguments and Output
Content: View full analysis
``` ### Technical Analysis The bearer session token is stored unencrypted in `.session_token`. The call to `fs.writeFileSync()` does not specify a restrictive file mode, so the resulting permissions depend on the process umask and existing file permissions. On a shared or incorrectly configured system, another local user or process may be able to read the token. The token is additionally exposed through several channels: - The `save` command accepts it as a command-line argument, potentially exposing it through process inspection, command history, execution telemetry, or Agent transcripts. - The `save` command returns the complete token in its JSON output. - The `load` command prints the raw token. - The `check` command returns the raw token in its JSON output. A bearer token is sufficient to authenticate with ...[truncated 1625 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: generate-device-id.js:12
Finding: Predictable and Non-Device-Bound Device Identifier
Content: View full analysis
`. 3. The attacker submits the predictable identifier to the authentication-start endpoint with the victim's phone number. 4. If the server treats the identifier as sufficient evidence of a recognized device, it may route the session directly to PIN verification instead of requiring the new-device OTP step. 5. The attacker can then attempt PIN authentication, subject to the server's PIN rate limits and lockout controls. F ...[truncated 1166 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script prints the session token directly to stdout in both the load and check flows, and also echoes it after save. Session tokens are bearer credentials, so exposing them to terminal history, logs, calling processes, shell pipelines, or agent transcripts can allow immediate account/session hijacking. In an agent skill context, stdout is especially sensitive because other tools or orchestration layers may automatically capture and persist outputs.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · skill.md (reported line 175)May include surrounding context.
GET /contacts?page=&limit=&search= → { contacts[], total, page, totalPages } POST /contacts { "name":"Mum", "phoneNumber":"09012345678" } → { ok, contact } PATCH /contacts/:id { "name":"Mother" } or { "phoneNumber":"..." } or both → { ok, contact } DELETE /contacts/:id → { ok, message:"Contact deleted" } GET /contacts/search?name=mum → { ok, contacts: [{ id, name, phoneNumber }] } (max 5 results)

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script stores the session token in a predictable plaintext file (.session_token) in the script directory without access controls, encryption, or permission hardening. Any local user, process, backup system, or adjacent tool with filesystem access may read and reuse the token, resulting in credential theft and persistent session compromise. The skill context increases risk because shared workspaces and automated agents often run with broad file visibility.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skill.md (reported line 11)May include surrounding context.
md
These Node.js scripts live in the `pay-bills-skill/` directory. Run them with `node` to generate IDs and manage auth state. | Script | Command | Purpose | | ----------------------- | ----------------------------------------------------- |------------------------------------------------------------------------------------------------------------------------------------| | `generate-order-id.js` | `node pay-bills-skill/generate-order-id.js` | Outputs a unique `ORDER_<timestamp>_<random>` string. Use this as `trx_id` for every order — **never hardcode or reuse a trx_id**. | | `generate-device-id.js` | `node pay-bills-skill/generate-device-id.js [userId]` | Outputs a device ID. With `userId`: `openclaw_<userId>`. Use as `deviceId` in auth requests. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skill.md (reported line 15)May include surrounding context.
md
| ----------------------- | ----------------------------------------------------- |------------------------------------------------------------------------------------------------------------------------------------| | `generate-order-id.js` | `node pay-bills-skill/generate-order-id.js` | Outputs a unique `ORDER_<timestamp>_<random>` string. Use this as `trx_id` for every order — **never hardcode or reuse a trx_id**. | | `generate-device-id.js` | `node pay-bills-skill/generate-device-id.js [userId]` | Outputs a device ID. With `userId`: `openclaw_<userId>`. Use as `deviceId` in auth requests. | | `session-token.js` | see below | Manages the session token for auth. | ### Session Token Commands

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly instructs persistence of a bearer session token to a local .session_token file and provides commands to print or load that token without any warning about secure storage, access control, redaction, or user consent. Because bearer tokens grant authenticated access, exposing or weakly storing them can enable account takeover or unauthorized purchases if the token is read from logs, terminal history, shared workspaces, or local files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The authentication flow collects highly sensitive information including phone numbers, OTPs, 4-digit PINs, full name, email, and session tokens, but the skill provides no privacy/safety guidance, no minimization advice, and no warning about how these secrets should be handled. In an agent setting, this increases the risk that users disclose credentials and verification codes into channels that may be logged, replayed, or mishandled, enabling unauthorized access to the financial account.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.