Agent Cashflow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent revenue-reporting helper, but it needs review because it misstates wallet privacy, suggests sending financial reports to Telegram and memory, and encourages reputation manipulation.

Review before installing or copying the examples. Use ETH tracking only if you are comfortable sending the wallet address to public RPC providers, avoid the Telegram/memory cron prompt unless you want those reports stored and forwarded, and do not follow the multiple-account starring advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

other

Warning

• Location: SKILL.md:96
• Finding: Ethereum Wallet Address Transmitted to Third-Party RPC Providers Despite Contrary Privacy Claim<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 96-104 and line 162 **Vulnerability Type**: Privacy disclosure inconsistency **Risk Level**: Medium ### Vulnerable Code ```python def get_eth_balance(address: str) -> float: payload = {"jsonrpc":"2.0","method":"eth_getBalance", "params":[address,"latest"],"id":1} for url in ["https://eth.llamarpc.com", "https://rpc.ankr.com/eth"]: try: r = requests.post(url, json=payload, timeout=8) ``` The documented privacy claim states: ```text - Does not store or transmit your wallet address to any third party ``` ### Technical Analysis The `get_eth_balance` function inserts the user's Ethereum wallet address into a JSON-RPC request and sends it to `eth.llamarpc.com` or `rpc.ankr.com`. Both endpoints are externally operated third-party services. This behavior directly contradicts the documented claim that the skill does not transmit the wallet address to third parties. Although an Ethereum address is public on-chain, associating it with request metadata such as an IP address, request timing, user agent, or service account can reveal additional information about its owner. The fallback logic may expose the same address to more than one provider if the first provider fails. The documentation does not disclose these recipients, explain their data-handling policies, or request informed consent. ### Attack Path 1. A user configures their Ethereum wallet address for optional balance tracking. 2. The user or a scheduled agent executes the supplied report code. 3. `get_eth_balance` places the address in an `eth_getBalance` JSON-RPC request. 4. The request is sent to `https://eth.llamarpc.com`. 5. If that request fails or does not produce a usable result, the address may also be sent to `https://rpc.ankr.com/eth`. 6. The RPC provider can log the wallet address together with network and timing metadata. 7. The provider, a compromised provider, or a party with ...[truncated 587 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the inaccurate statement that wallet addresses are never transmitted to third parties. 2. Clearly identify every default RPC provider and explain that the wallet address and request metadata are disclosed to those providers. 3. Require explicit user consent before enabling wallet tracking. 4. Allow users to configure their own trusted RPC endpoint, including a locally operated Ethereum node. 5. Disable automatic fallback to additional providers unless the user has approved each provider. 6. Provide a local-only mode that omits Ethereum balance tracking. 7. Document provider privacy policies, expected logging behavior, and data-retention implications. 8. Minimize identifying request metadata where possible and avoid adding unnecessary authentication or tracking headers. ]]>

other

Warning

• Location: SKILL.md:149
• Finding: Scheduled Reports Disclose and Persist Financial Data Through Telegram and Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 149-153 **Vulnerability Type**: Sensitive data persistence and external disclosure **Risk Level**: Medium ### Vulnerable Code ```bash openclaw cron add \ --name "cashflow:daily" \ --cron "0 7 * * *" \ --prompt "Run agent-cashflow skill. Send results to Telegram and memory." ``` ### Technical Analysis The scheduling example creates a recurring task that sends cashflow reports to Telegram and writes them into persistent agent memory. The generated report can contain skill performance statistics, estimated revenue, an Ethereum wallet balance, and the balance's USD valuation. Telegram is an external communication channel, while agent memory is a persistent storage location that may remain available across sessions. The instructions do not require explicit consent for either destination, provide redaction controls, define retention limits, or warn users that financial information will leave the immediate execution context. The scheduled execution also repeats this disclosure daily, increasing both the quantity of retained data and the period over which financial activity can be reconstructed. This is not classified as agent memory poisoning because the persisted content is report data rather than attacker-controlled behavioral instructions. ### Attack Path 1. A user copies and executes the documented `openclaw cron add` command. 2. A persistent daily scheduled task is registered. 3. At 07:00 each day, the agent runs the cashflow skill and retrieves portfolio and optional wallet information. 4. The resulting report is sent to the configured Telegram destination. 5. The same report is written to persistent agent memory. 6. Anyone who gains access to the Telegram account, destination chat, bot infrastructure, agent memory, memory backups, or later authorized sessions may retrieve the financial data. 7. Accumulated daily reports may reveal changes in wallet balance, portfolio performa ...[truncated 560 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default scheduled reports to local output rather than Telegram or persistent memory. 2. Make each external destination and persistence option separately opt-in. 3. Display a clear warning before scheduling reports that contain wallet balances or revenue information. 4. Provide configurable redaction options for wallet addresses, balances, USD valuations, skill names, and revenue figures. 5. Allow users to select a destination explicitly rather than embedding Telegram and memory in the default prompt. 6. Define retention periods and provide documented procedures for deleting historical reports from agent memory. 7. Recommend encrypted, access-controlled destinations when remote delivery is required. 8. Validate the destination before sending reports to reduce the risk of disclosure to the wrong chat or account. 9. Offer a summary-only scheduling mode that excludes wallet and other sensitive financial data. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation states that the skill does not transmit the wallet address to any third party, but the provided code sends the wallet address to public Ethereum RPC endpoints to query balance. This is a security-relevant misrepresentation because users may disclose financial identifiers under false privacy assumptions, enabling unintended third-party exposure and trust erosion.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The skill explicitly encourages users to star their own skills from multiple accounts to boost visibility, which is coordinated manipulation of platform reputation signals. This can facilitate fraud, undermine marketplace integrity, and expose users to account enforcement or broader trust and abuse issues.

External Transmission

Medium

• Category: Data Exfiltration

Content

"params":[address,"latest"],"id":1}
    for url in ["https://eth.llamarpc.com", "https://rpc.ankr.com/eth"]:
        try:
            r = requests.post(url, json=payload, timeout=8)
            result = r.json().get("result")
            if result:
                return int(result, 16) / 1e18

• Confidence: 92% confidence
• Finding: The code transmits the user's wallet address to external Ethereum RPC providers when requesting a balance. While this is functionally necessary for remote balance lookups, it still exposes a financial identifier to third parties and becomes more concerning because the skill later claims no such transmission occurs.

External Transmission

Medium

• Category: Data Exfiltration

Content

def get_eth_price() -> float:
    try:
        r = requests.get(
            "https://api.coingecko.com/api/v3/simple/price?ids=ethereum&vs_currencies=usd",
            timeout=8
        )
        return r.json()["ethereum"]["usd"]

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The scheduled example instructs the system to send results to Telegram and memory without clearly warning that portfolio metrics and potentially wallet-related data may be transmitted to external services or persisted. In an automation context, silent forwarding increases the chance of oversharing operational or financial information beyond the user's intended audience.

Static analysis

No suspicious patterns detected.