Security audit

raiffeisen-elba

Security checks across malware telemetry and agentic risk

Overview

This looks like a real local banking automation skill, but it needs Review because it stores banking credentials/session material and includes under-documented document-download capabilities.

Install only if you are comfortable auditing and running local code that automates your bank login, stores your ELBA ID and PIN in a local file, caches a bearer session token until logout, and can export financial data and documents to disk. Always run logout afterward, keep the workspace private, and avoid using this on shared or backed-up machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill advertises substantial capabilities—network access, shell execution, file read/write, and use of local environment or credentials—without declaring permissions or clearly constraining them. In a banking automation context, this reduces transparency and informed consent, making it easier for a user to run a skill that can access sensitive financial data and local secrets beyond what the manifest suggests.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose understates the actual behavior: beyond login and transactions, the skill appears to extract and cache bearer tokens, access mailbox/documents APIs, and retrieve portfolio and securities history. In a banking skill, this mismatch is especially dangerous because users may grant trust and provide credentials expecting limited automation, while the skill can access a materially broader set of highly sensitive financial information and reusable session artifacts.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script materially exceeds the stated skill scope by collecting banking documents through direct authenticated API calls, not just login/account listing/transaction retrieval via Playwright. In a banking context, expanding access to additional sensitive artifacts increases the risk of unauthorized data collection and misuse, especially because documents may contain statements, notices, tax records, or other regulated financial information.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The code actively extracts bearer tokens from browser storage and network traffic, then reuses them outside the browser session to call backend APIs directly. This is dangerous because it bypasses the normal interaction boundary of browser automation and turns a logged-in session into a reusable credential source, increasing the blast radius if tokens are exposed, mishandled, or repurposed.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The module advertises collection of documents via an API endpoint, which conflicts with the skill description centered on Playwright-based banking automation for login, accounts, and transactions. In security review, this mismatch is a meaningful signal of undocumented capability expansion and makes the skill more dangerous because users and reviewers may not expect document harvesting behavior.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script adds functionality to download banking documents, which is outside the declared skill scope of login/logout, account listing, and transaction retrieval. In a banking context, documents often contain highly sensitive financial and personal data, so this materially expands data access beyond what a user or reviewer would expect from the manifest.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code intentionally extracts bearer tokens from browser storage and by intercepting authenticated API requests, which is effectively credential/session harvesting. Even if used locally, this bypasses normal application boundaries and creates a reusable authentication artifact that could be abused to access banking APIs and sensitive documents outside the intended browser workflow.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill behavior exceeds its stated scope by downloading mailbox documents and exposing portfolio/depot retrieval in addition to login, account listing, and transactions. In a banking context, undocumented expansion of data access is security-relevant because it increases the amount of sensitive financial information the skill can extract without clear user expectation or consent.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The code goes beyond browser automation by extracting bearer tokens from browser storage, intercepting authenticated API requests, and then using those tokens for direct backend API calls. In a banking skill, this substantially increases power and stealth: token reuse can bypass UI constraints and enables broader or less visible access to account and portfolio data than users may reasonably expect from a 'via Playwright' automation skill.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill deliberately harvests bearer tokens from local/session storage and intercepted API requests, then caches them to disk for reuse. These tokens are highly sensitive banking session credentials; if exposed through local compromise, logs, backups, or other skills, an attacker could access banking APIs without re-entering credentials or completing the visible UI flow.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The module description understates the implemented capabilities by claiming only 'basic data retrieval' while the code includes document downloading, token capture, and portfolio/depot API access. In financial automation, misleading scope descriptions are dangerous because operators may authorize or deploy the skill without understanding the full range of sensitive data it can collect and persist.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script prints a prefix of the extracted bearer token, which is sensitive session credential material. Even partial token disclosure can leak secrets into logs, terminals, CI output, or monitoring systems and materially assist session hijacking or correlation of privileged sessions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script saves raw banking document metadata and a derived list to local disk without an explicit warning, consent step, encryption, or retention policy. In a financial context, local persistence of sensitive records increases the chance of unintended disclosure through shared workspaces, backups, other local users, or later compromise of the host.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script collects both bearer tokens and session cookies and reuses them for direct API calls without any explicit warning, consent, or disclosure to the user. In a banking automation skill, silent handling of active session material increases the risk of unauthorized access, accidental retention, and misuse of authenticated state.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script exports complete bank transaction records to CSV and JSON on disk, including highly sensitive fields such as IBANs, counterparties, references, and balances, without any explicit warning, consent checkpoint, or secure-at-rest handling. In an agent skill context, this increases the risk of unintended local persistence, later exfiltration, or accidental sharing of financial data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup flow stores ELBA banking credentials in plaintext JSON on disk, with no prominent warning to the user beyond file creation. Even with restrictive file permissions, plaintext banking credentials are at risk from local compromise, accidental backups, workspace sharing, or other tools reading the file, making this especially sensitive in a banking context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Bearer session tokens are cached to disk without clear disclosure, creating a reusable local authentication artifact for banking APIs. In this context, token theft may be as damaging as password theft because it can allow authenticated API access until expiry, potentially without additional user interaction or 2FA.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.