Conto

• Outcome: Review
• Latest audit: Jul 16, 2026 · 6:08 AM UTC
• Version: 1.9.0

Overview

The skill is mostly transparent about payment-policy management, but it can approve and execute real transfers, mutate policies, and store credentials, so it should be reviewed carefully before installation.

Install only if you intend this agent to participate in real payment-policy enforcement. Prefer a standard SDK key unless policy administration is required, use low limits and testnet first, protect ~/.openclaw/openclaw.json, and require explicit per-transaction human confirmation before any wallet transfer or approval decision.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill requires network, shell, and file-write capabilities, including writing credentials to ~/.openclaw/openclaw.json, but those capabilities are not explicitly declared. That creates a trust and review gap: operators may install a skill expecting only policy checks while it can also persist secrets locally and invoke external commands, increasing the blast radius if the skill or its dependencies are modified or abused.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The stated purpose is payment-policy enforcement, but the skill also performs privileged setup, browser-based auth, credential storage, policy administration, and approval decisions. This scope expansion matters because users may grant trust for a narrow control-plane function while the skill can materially change policies, approve requests, and alter persistent configuration, enabling unauthorized or unexpected financial control if misused.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill description says it enforces spending policies before payments, but the implementation also exposes full policy administration primitives such as create, update, and delete for policies and rules. This expands the skill from a guardrail into a control-plane tool, so an agent using it could weaken or remove protections before initiating transfers, defeating the stated safety boundary.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill does not merely check whether a payment complies with policy; it can also approve or deny pending approval requests. That allows the same agent ecosystem to act as an approval authority, undermining separation of duties and potentially letting an automated workflow self-approve transactions that were supposed to require human review.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The README says the skill can activate automatically when users 'mention policies/payments naturally' without defining strict trigger boundaries or requiring an explicit /conto invocation. In a wallet-control skill, ambiguous activation increases the chance that unrelated conversation text, prompt-injected third-party content, or social-engineering messages could cause policy-management or payment-approval flows to start unintentionally.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explains that external wallets may execute the exact approved transfer and managed wallets may send automatically after approval, but it does not foreground this with a prominent warning earlier in setup and usage. Users may install and configure the skill without fully appreciating that it can result in real asset movement once approvals are satisfied, increasing the risk of unsafe deployment or accidental authorization.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The setup flow persists the SDK key into a local JSON config file without clearly warning the user that a bearer credential will be stored on disk. If the file permissions are weak, the machine is shared, or logs/backups expose the file, the key can be stolen and used to approve payments or administer policies depending on its scope.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Step 2a: Execute the Transfer

**Now execute the payment using your wallet.** Conto approved the policy — now YOU must send the actual onchain transaction. Do NOT ask the user to execute it.

Use the appropriate MCP tool for the target chain:

• Confidence: 97% confidence
• Finding: Do NOT ask the user

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.