Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed local finance-learning logger with optional reminder hooks, but users should keep automation project-scoped and avoid logging real financial data.
Install this only if you want persistent local finance learning logs. Keep hooks project-scoped, prefer the activator-only hook, review any generated skill before use, and do not log real account numbers, bank details, client names, taxpayer IDs, or exact sensitive amounts.
The declared purpose is passive finance logging, but the skill also directs initialization writes, hook installation, repository cloning, and reusable skill extraction workflows. This mismatch is dangerous because users or agents may authorize it for benign note-taking while it actually expands into broader persistence and artifact modification behavior not implied by the description.
Referenced artifact was not completely inspected
Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.
The file header and usage text state that this script 'Creates a new skill from a finance learning entry,' and the implementation follows through by generating a new skill scaffold. That behavior does not match the manifest's claimed operational scope of capturing reconciliation, control, valuation, regulatory, and cash-flow anomalies for finance operations improvement.
The manifest describes a skill for detecting and capturing finance issues such as reconciliation errors, forecast variances, control weaknesses, and regulatory gaps to support continuous finance improvement. This script instead scaffolds entirely new skills by creating directories and writing SKILL.md files, which is a repository maintenance/development capability rather than a finance-analysis capability.
The skill contains operational commands and references to cloning repositories, enabling hooks, and running helper scripts, but it does not declare any explicit tool or permission scope. That omission weakens the trust boundary because an agent may execute filesystem or network-capable actions without a clear least-privilege contract, making review and enforcement harder.
The skill goes beyond capturing finance anomalies and encourages promoting content into AGENTS.md, control matrices, checklists, tax calendars, and other operational artifacts. Even with some approval language later, this broadens the blast radius from local logging to governance and workflow changes, which can alter agent behavior or organizational processes.
The OpenClaw setup writes under ~/.openclaw/workspace/.learnings, which is a persistent user-level workspace location rather than an ephemeral task directory. Persistent storage increases the chance that sensitive finance-related metadata accumulates across sessions and projects, and it can influence future agent behavior long after the original task ends.
└── FEATURE_REQUESTS.md
### Create Learning Files
```bash
mkdir -p ~/.openclaw/workspace/.learnings
The skill instructs installation of persistent hooks that inspect future prompts and tool output across sessions. Persistence materially increases risk because a one-time invocation can create ongoing monitoring and trigger behavior later, potentially affecting unrelated work and expanding data exposure beyond the original finance task.
The automatic trigger conditions are broad enough to match many normal finance conversations and routine operational states. Over-triggering is dangerous because it can cause excessive logging, alert fatigue, unnecessary writes, and accidental capture of sensitive business context in situations where the user did not intend to invoke persistent recording.
The hook matchers use common keywords such as audit, close, budget, and forecast, which are likely to activate during ordinary conversation. When combined with persistence, these broad patterns can silently extend monitoring and trigger scripts on unrelated prompts or tool use, increasing privacy and operational risk.
The extraction workflow creates new reusable skills from logged content, turning a finance logging tool into a code/content generation mechanism. This is risky because it can propagate unreviewed instructions, amplify prompt-injection content embedded in logs, and create persistent artifacts that future sessions may trust or load.
Allowing the skill to read other skill folders for cross-linking creates an unnecessary enumeration capability over adjacent skills and their content. In a multi-skill environment, this can expose sensitive instructions, internal metadata, or prompt material from unrelated skills, increasing cross-context data leakage risk.
### Ownership Rules
- This skill writes only to `.learnings/finance/` in stackable mode.
- It may read other skill folders for cross-linking, but should not rewrite their entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### Correct Treatment
**Before (control gap):**
ERP threshold set at $10K — entries below this amount bypass approval.
**After (remediated):**
ERP threshold set to $0 — all journal entries require dual approval.
The feature request explicitly proposes 'Auto-approve perfect matches and create payment proposals,' which delegates an approval action to automated logic without requiring a human review checkpoint. In a finance/AP context, this can enable erroneous or manipulated invoices, bad tolerance configurations, duplicate payments, or fraud scenarios to pass straight through to payment initiation at scale.
2. Apply matching rules: quantity within 2% tolerance, price within $X or 1%
3. Route exceptions by type: price variance → procurement, quantity → warehouse, missing GR → receiving
4. Dashboard showing match rate, exception aging, and processing time
5. Auto-approve perfect matches and create payment proposals
### Metadata
- Frequency: recurring
The PostToolUse hook is configured for all Bash tool use, so any Bash execution can invoke the detector regardless of whether the command relates to finance. In an agent environment, this broad trigger increases the frequency of script execution and may expose arbitrary tool output via environment variables, including sensitive data unrelated to the intended finance use case.
The UserPromptSubmit matcher includes broad terms such as 'close,' 'audit,' 'budget,' and 'forecast,' which can appear in many normal prompts and trigger the hook unexpectedly. Because the hook executes a script on each match, overbroad activation expands the execution surface and can cause unnecessary exposure of prompt context to the script or nuisance command execution.
The document states that the scripts 'only output text' and 'don't modify files or run commands,' but the documented hook mechanism explicitly invokes shell commands. That mismatch can cause operators to underestimate the trust boundary and enable hooks they believe are passive, even though arbitrary shell scripts will execute with the agent's permissions.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
openclaw hooks enable self-improving-finance
### 3. Create Learning Files
```bash
mkdir -p ~/.openclaw/workspace/.learnings
The later ownership rules sharply limit writes and require explicit approval for promotion targets, while earlier sections describe promotion and extraction as part of the workflow in a more action-oriented manner. This creates intent ambiguity about whether these modifications are central behavior or restricted exceptional actions.
The context field lists the trigger as "reconciliation," which is a broad natural-language term that could overlap with many ordinary finance discussions rather than a narrowly scoped invocation phrase. The file does not provide explicit activation boundaries, exclusions, or negative examples to clarify when this trigger should or should not activate a skill.
No suspicious patterns detected.