Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent financial observability package, but it can expose sensitive transaction and budget data over unauthenticated network endpoints by default.
Review this before installing in any shared, cloud, container, or LAN-reachable environment. Do not enable the built-in dashboard or Prometheus exporter unless you can bind them to localhost or protect them with network controls and authentication. Treat JSONL files, webhook payloads, dashboard responses, and metrics as sensitive financial records because they can include agent IDs, task IDs, counterparties, descriptions, tags, amounts, revenue, PnL, and timing data.
agentfinobs/dashboard.py:44Unauthenticated Dashboard Exposes Financial Data on All Network Interfaces
agentfinobs/prometheus.py:130Prometheus Exporter Publicly Exposes Agent Financial Metrics
agentfinobs/tracker.py:189Transaction Records Are Persisted in Plaintext with Ambient File Permissions
The declared description promises a full-featured financial observability capability spanning monitoring, budgeting, anomaly detection, and payment-rail integrations. The supplied code chunk only contains a module docstring for an integrations package and mentions a LangChain/LangGraph callback handler. There is no visible implementation of the described financial features or payment integrations in this chunk. Because the actual code shown serves a different, much narrower purpose and does not substantiate the declared functionality, this is a mismatch.
The README advertises a built-in HTTP dashboard and webhook export capability but does not warn that exposing these interfaces can leak transaction history, spending metrics, budget state, or other operationally sensitive financial telemetry. In an agent-finance observability tool, this omission can lead users to deploy the dashboard or exporters on reachable interfaces without authentication, network restrictions, or data minimization.
The documented dashboard endpoints include full metrics, alerts, budget status, and recent transactions, all of which may reveal sensitive business and financial information if the dashboard is exposed. Because the skill is specifically for monitoring agent spending across payment rails, the listed endpoints materially increase the sensitivity of the exposed data and make undocumented open access more dangerous.
The skill declares no explicit tool scope or permissions despite advertising features that imply network access, file output, and possibly shell execution. In agent environments, missing scope declarations can cause overbroad default privileges, making it easier for the skill to write files, send data externally, or invoke commands without transparent user approval.
The dashboard starts an HTTP server bound to 0.0.0.0 and exposes sensitive financial observability data such as recent transactions, budget status, alerts, and anomaly statistics without any authentication or authorization checks. In the context of an AI financial monitoring tool, this can leak operational and potentially payment-related metadata to anyone with network access, and the wildcard CORS header further increases the chance of unintended cross-origin access from browsers.
This code file defines a built-in exporter that POSTs transaction batches to any configured endpoint, which is a safety-relevant network transmission of user/system data. While the docstring explains usage, it does not warn that enabling this exporter transmits transaction data off-host or advise users to verify the destination and contents.
This code automatically records every LLM/chat call as a financial transaction and captures metadata including model name, token counts, and latency. Although the module docstrings describe the behavior, there is no runtime disclosure, confirmation, or visible user-facing warning for this automatic tracking, which affects observability data about user/system activity.
The tracker pushes every recorded transaction to all registered exporters via exp.export_tx(tx), which may transmit transaction details to external systems. Although the class docstring shows a webhook exporter example, this code file does not include a confirmation prompt or explicit user-facing warning about that outbound data sharing behavior.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
class TestCLI(unittest.TestCase):
def test_version(self):
import subprocess
result = subprocess.run(
["python", "-m", "agentfinobs", "version"],
capture_output=True, text=True,
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def test_demo(self):
import subprocess
result = subprocess.run(
["python", "-m", "agentfinobs", "demo"],
capture_output=True, text=True,
timeout=10,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
f.write(json.dumps(tx) + "\n")
import subprocess
result = subprocess.run(
["python", "-m", "agentfinobs", "status", path, "--budget", "100"],
capture_output=True, text=True,
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def test_status_missing_file(self):
import subprocess
result = subprocess.run(
["python", "-m", "agentfinobs", "status", "/nonexistent.jsonl"],
capture_output=True, text=True,
)
When persist_dir is provided, the tracker creates a directory and appends transaction records to a JSONL file on disk. While the module docstring mentions periodic persistence, the code path performing the write lacks a direct user-facing disclosure near the file creation and append operations.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
This test invokes JsonlExporter to write transaction data to a filesystem path, but the file contains no comment, docstring, or other disclosure near the operation indicating that transaction data is persisted to disk. Under the code-file criteria, file writes can warrant a finding when there is no visible warning or explanatory disclosure in the code being reviewed.
No suspicious patterns detected.