Accounted Openclaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 1.0.0

Overview

This bookkeeping skill is coherent and mostly transparent, but it asks agents to trust mutable remote playbooks and offers an unpinned npm bridge for sensitive accounting access.

Prefer the hosted OAuth setup with read-only scopes first, grant only the write scopes needed, and use a sandbox company for initial testing. Avoid the API-key `npx` bridge unless you can verify or pin the `gnubok-mcp` package. Treat loaded playbooks as workflow suggestions and keep the documented per-operation approval rule in force for every accounting change.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned npm Package Execution in the MCP Bridge Setup

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:43 and README.md:40
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:43:

bash

openclaw mcp add accounted --command npx --arg gnubok-mcp

README.md:40:

bash

openclaw mcp add accounted --command npx --arg gnubok-mcp

Technical Analysis

The API-key installation path configures npx to execute the gnubok-mcp package without specifying an exact version or an integrity constraint. When the MCP bridge is launched, package resolution can therefore select a package release that differs from the release reviewed or tested by the project author.

The package's executable source is not included in this repository, and the project does not provide a lockfile, cryptographic checksum, package signature, or other mechanism that binds execution to a known artifact. This creates a supply-chain trust boundary outside the audited project.

The issue does not establish that the current npm package is malicious. It means that a future compromised, malicious, or unexpectedly incompatible package publication could change the code executed by users without requiring any change to this skill.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or another relevant publication mechanism.
2. The attacker publishes a modified release under the package name gnubok-mcp.
3. A user selects the documented API-key and stdio-bridge installation option.
4. OpenClaw launches the configured npx gnubok-mcp command.
5. npx resolves and executes the altered package because no reviewed version or integrity value is pinned.
6. The package runs with the local privileges of the OpenClaw process and can attempt to access resources available to that process.

Impact Assessment

A compromised package could execute arbitrary code with the privi ...[truncated 618 chars]

Remediation

View remediation

Remediation Suggestions

• Pin gnubok-mcp to an exact, reviewed version rather than relying on implicit package resolution.
• Record and verify the expected package integrity hash through an npm lockfile or an equivalent verified installation process.
• Avoid automatic installation or upgrade to the latest package release when the MCP server starts.
• Document the expected npm publisher, exact package version, and verification procedure.
• Prefer installing the dependency during a controlled setup phase and launching the already verified local executable afterward.
• Run the bridge with minimal filesystem access and a restricted environment.
• Grant the API key only the scopes required for the immediate task, and use a sandbox key for initial testing.
• Apply the same correction to both SKILL.md and README.md so that the documented installation paths remain consistent.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:60

Finding

Mutable Remote Playbooks Are Treated as Authoritative Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:60 and SKILL.md:92
Vulnerability Type: Untrusted remote instruction delegation
Risk Level: Medium

Vulnerable Code

SKILL.md:60:

markdown

- **Discovery:** `gnubok_search_tools(query="…")` ranks the catalog; `gnubok_list_skills` lists server-side playbooks (month-end close, VAT review, year-end, payroll, bank reconciliation, kreditfaktura…). For any multi-step job, `gnubok_load_skill` the matching playbook FIRST and follow it — it is maintained against the live ledger rules and is more current than this file.

SKILL.md:92:

markdown

Load the authoritative playbook first: `gnubok_load_skill("month-end-close")`. The shape:

Technical Analysis

The skill directs the agent to retrieve server-side playbooks and follow them as authoritative instructions. It also states that the remote material is more current than the locally installed and audited skill. The contents and versions of those playbooks are not present in this repository, so their effective instructions cannot be verified by this audit.

This establishes a mutable remote instruction channel. If the Accounted service, a playbook-management account, or the playbook publication process were compromised, altered content could be returned after the local skill had already passed review. Because the local text tells the agent to follow that content first and treats it as authoritative, malicious playbook prose could influence subsequent behavior.

The local approval contract provides meaningful protection for documented accounting writes: staged operations must be shown to the user and individually approved. However, the skill does not explicitly state that remote playbook instructions are untrusted data, restrict them to a defined set of bookkeeping operations, or state that local safety constraints always override remote playbook content.

Attack Path

1. An attacker obtains the ab ...[truncated 1602 chars]

Remediation

View remediation

Remediation Suggestions

• Treat loaded playbooks as untrusted workflow data rather than unrestricted agent instructions.
• State explicitly that local safety requirements, system policies, user intent, scope limits, and per-operation approval rules always override remote content.
• Restrict playbooks to a validated schema containing permitted workflow steps and known gnubok_* tool identifiers.
• Reject playbook content that requests shell commands, unrelated tools, credential disclosure, security-control changes, or instructions outside the requested accounting task.
• Version and cryptographically sign playbooks, and verify their signatures and expected publisher before use.
• Pin known playbook versions where practical and display the selected version to the user.
• Require renewed user confirmation if a remote playbook introduces operations not reasonably implied by the original request.
• Preserve the rule that every staged operation must be presented and approved individually, regardless of any contrary statement in a remote response.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to install and run an MCP bridge via npx gnubok-mcp without pinning an exact package version or integrity source. That creates a supply-chain risk: a future malicious or compromised package release, dependency hijack, or typo/registry confusion could cause arbitrary code execution on the user's machine during setup, which is especially relevant because this bridge may be given access to accounting data or API credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users to run an unpinned package via npx, which fetches and executes whatever version is current at install time. If the package is compromised, typo-squatted, or a malicious update is published, this becomes arbitrary code execution on the user's machine during setup.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

4. Monthly VAT filers: run the moms workflow for the month
5. `gnubok_lock_period` → stages; it refuses while unbooked transactions remain

### Reports (read-only, no approval needed)

`gnubok_get_trial_balance` / `_income_statement` / `_balance_sheet` / `_kpi_report` / `_ar_ledger` / `_supplier_ledger` — default to the latest fiscal period. Account roll-ups: `gnubok_get_general_ledger`. Ad-hoc queries (free text, amount/date filters): `gnubok_query_journal`. SIE4 export: `gnubok_export_sie`.

Static analysis

No suspicious patterns detected.