laso-finance

• Outcome: Review
• Latest audit: Aug 15, 2026 · 5:21 AM UTC
• Version: 1.0.0

Overview

This is a legitimate finance skill, but it gives agents broad authority to reuse stored credentials and move money without consistently requiring fresh user confirmation.

Install only if you intentionally want an agent to manage Laso payments. Treat saved Laso credentials like banking credentials, keep them out of repositories and shared logs, and require the agent to ask for clear approval before purchases, transfers, withdrawals, banking changes, webhook registration, or credential persistence.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest description is broad enough to trigger on many common shopping, payment, and finance tasks, which increases the chance the skill is invoked in contexts where the user did not explicitly intend to spend money or move funds. In a finance skill with real payment capabilities, overbroad routing materially raises the risk of unintended financial actions.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill can spend USDC, transfer funds, order cards, and initiate irreversible or difficult-to-reverse financial operations, yet the manifest lacks a prominent upfront warning and confirmation requirement. Without an early warning, an orchestrator or user may treat it like an informational finance skill rather than a money-moving capability.

Credential Access

High

• Category: Privilege Escalation

Content

author: laso-finance
  mintlify-proj: lasofinance
  version: "1.0"
  credentialsPath: ~/.laso/credentials.json
  openclaw:
    emoji: "💵"
    category: finance

• Confidence: 92% confidence
• Finding: The manifest advertises a fixed credential path and the skill repeatedly instructs the agent to read and write long-lived secrets from disk. In an adversarial skill ecosystem, encouraging automatic credential discovery and persistence increases the blast radius of prompt injection, data leakage, or cross-skill secret harvesting.

Credential Access

High

• Category: Privilege Escalation

Content

LASO FINANCE API — QUICK REFERENCE
Base:   https://laso.finance          Callables: https://us-central1-kyc-ts.cloudfunctions.net/<name>
Auth:   Authorization: Bearer <id_token>    (~1h TTL; mint via agentAuth or GET /auth)
Creds:  $LASO_API_KEY, else ~/.laso/credentials.json    <- CHECK BEFORE ANY ONBOARDING
Pay:    x402, USDC on Base or Solana. Managed accounts never build a payment header.
Docs:   this file | /openapi.json | GET /version (free) | /.well-known/docs-version.json

• Confidence: 94% confidence
• Finding: The quick-reference block explicitly tells the agent to check environment variables or a local credential file before onboarding, normalizing autonomous secret retrieval. For a skill that can spend money, this materially increases the risk that a compromised or misrouted invocation accesses reusable financial credentials without a fresh user decision.

Credential Access

High

• Category: Privilege Escalation

Content

- The `id_token` expires after ~1 hour.
- When it expires, call `POST /auth` with `grant_type: "refresh_token"` and your `refresh_token` to get a new `id_token`.
- `/auth` and `/get-card` return fresh `id_token` and `refresh_token` in the response. Write them back to `~/.laso/credentials.json` every time (see [Saving your credentials](#saving-your-credentials)), along with an updated `id_token_expires_at`, so the next session starts with a token it can use immediately.
- Check `id_token_expires_at` before making a call rather than discovering the expiry as a `401`. If it has passed, refresh first.
- If the refresh itself fails, fall back to your stored `api_key` and re-run [Sign in with your key](#sign-in-with-your-key). Only ask your human for a new key if that also fails; a stored `lasoak_` key does not expire.

• Confidence: 95% confidence
• Finding: The token-management guidance instructs persistent storage and refresh of API keys, refresh tokens, and ID tokens, creating durable local secrets that can authorize payments and account actions. If another tool, prompt injection, or compromised environment accesses that file, an attacker could reuse the credentials to spend funds or access sensitive financial data.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.