Security audit

Bankr

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a disclosed Bankr crypto and LLM integration, but it needs Review because it can store wallet-capable keys and immediately sign or submit live crypto transactions.

Install only if you are comfortable giving Bankr and this CLI access to the selected wallet authority. Prefer read-only keys unless you need trades, keep write-enabled wallets low-balance and separate from personal holdings, use separate LLM and Agent API keys, restrict IPs where possible, avoid committing ~/.bankr or .env files, and manually review every signature, permit, approval, bridge, bet, leveraged trade, NFT purchase, and raw transaction before authorizing it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:53
Finding: Unpinned Global Installation of a Third-Party CLI Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/llm-gateway.md:11
Finding: Wallet-Capable Credentials Stored and Exposed Through Plaintext Interfaces
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/sign-submit-api.md:105
Finding: Immediate Signing and Arbitrary Transaction Submission Without Mandatory User Authorization
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (61)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/api-workflow.md (reported line 251)May include surrounding context.
done

text
## Output Guidelines ### Response Formatting

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/llm-gateway.md (reported line 194)May include surrounding context.
bankr llm claude

Pass any Claude Code flags through

bankr llm claude --model claude-sonnet-4.6 bankr llm claude --allowedTools Edit,Write,Bash bankr llm claude --resume

text

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document describes betting, redeeming positions, and automatic cross-chain bridging from other wallets/chains, but it does not pair these capabilities with explicit warnings or safeguards about irreversible financial loss, bridge risk, slippage, wrong-chain transfers, or transaction finality. In this skill's context, that omission is more dangerous because the agent can facilitate real-money gambling-adjacent activity and move funds across chains, amplifying the likelihood of user harm from misunderstanding or accidental execution.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · references/sign-submit-api.md (reported line 129)May include surrounding context.
nTransaction| Missing transaction | | 401 |Authentication required| Missing or invalid API key | | 403 |Agent API access not enabled` | API key lacks agent access |

POST /agent/submit

Submit raw transactions directly to the blockchain.

Request Body

json
{ "transaction": { "to": "0x...", "chainId": 8453, "value": "1000000000000000000", "data": "0x..." }, "description": "Transfer 1 ETH", "waitForConfirmation": true }

Transaction Fields

Field Type Required Description
to string Yes Destination address
chainId number Yes Chain ID (8453=Base, 1=Ethereum, 137=Polygon)
value string No Value in wei (as string)
data string No Calldata (hex string)
gas string No Gas limit
gasPrice string No Legacy gas price
maxFeePerGas string No EIP-1559 max fee
maxPriorityFeePerGas string No EIP-1559 priority fe

Field	Type	Required	Description
`to`	string	Yes	Destination address
`chainId`	number	Yes	Chain ID (8453=Base, 1=Ethereum, 137=Polygon)
`value`	string	No	Value in wei (as string)
`data`	string	No	Calldata (hex string)
`gas`	string	No	Gas limit
`gasPrice`	string	No	Legacy gas price
`maxFeePerGas`	string	No	EIP-1559 max fee
`maxPriorityFeePerGas`	string	No	EIP-1559 priority fe

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This reference describes token trading, bridging, and conversion flows but does not prominently warn that these actions can spend real assets, incur fees, and be irreversible. In the context of an AI-powered crypto trading skill spanning multiple chains, the lack of a clear risk warning materially raises the likelihood of users authorizing dangerous actions without understanding the consequences.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises an extremely broad trigger scope covering trading, transfers, signing, raw transaction submission, and even general LLM access via natural language. In an agent ecosystem, this can cause over-invocation on ambiguous user requests and route sensitive finance or AI tasks into a high-risk capability surface without sufficiently narrow intent matching.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
All requests require an X-API-Key header:

bash
curl -X POST "https://api.bankr.bot/agent/prompt" \ -H "X-API-Key: bk_YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"prompt": "What is my ETH balance?"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
bash
# Start — the response includes a threadId curl -X POST "https://api.bankr.bot/agent/prompt" \ -H "X-API-Key: $BANKR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"prompt": "What is the price of ETH?"}'

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill encourages persistent agent-linked wallet accounts and stored credentials for ongoing autonomous use. While framed as a safety measure, session persistence and retained wallet authority increase the blast radius of compromise because a stolen API key or host compromise can continuously access balances, signing, and transaction capabilities.
Content: Scanner excerpt · SKILL.md (reported line 476)May include surrounding context.
md
## Safety & Access Control **Dedicated Agent Wallet**: When building autonomous agents, create a separate Bankr account rather than using your personal wallet. This isolates agent funds — if a key is compromised, only the agent wallet is exposed. Fund it with limited amounts and replenish as needed. **API Key Types**: Bankr uses a single key format (`bk_...`) with capability flags (`agentApiEnabled`, `llmGatewayEnabled`). You can optionally configure a separate LLM Gateway key via `bankr config set llmKey` or `BANKR_LLM_KEY` — useful when you want independent revocation or different permissions for agent vs LLM access.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 97% confidence
Finding: The documentation explicitly states that /agent/submit transactions execute immediately with no confirmation prompt. For a crypto trading and wallet-control skill, removing a human confirmation checkpoint before irreversible on-chain actions creates substantial risk of accidental, manipulated, or unauthorized transfers.
Content: Scanner excerpt · SKILL.md (reported line 490)May include surrounding context.
md
- Store keys in environment variables (`BANKR_API_KEY`, `BANKR_LLM_KEY`), never in source code - Add `~/.bankr/` and `.env` to `.gitignore` — the CLI stores credentials in `~/.bankr/config.json` - Test with small amounts on low-cost chains (Base, Polygon) before production use - Use `waitForConfirmation: true` with `/agent/submit` — transactions execute immediately with no confirmation prompt - Rotate keys periodically and revoke immediately if compromised at [bankr.bot/api](https://bankr.bot/api) **Reference**: [references/safety.md](references/safety.md)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The /agent/sign endpoint enables remote signature generation tied to wallet authority. In the context of a crypto agent skill, this is especially dangerous because signatures can be exploited to approve asset movement or authenticate harmful actions even without immediate on-chain broadcast.
Content: Scanner excerpt · SKILL.md (reported line 732)May include surrounding context.
bash
# Sign a plain text message curl -X POST "https://api.bankr.bot/agent/sign" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d '{"signatureType": "personal_sign", "message": "Hello, Bankr!"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The /agent/sign endpoint enables remote signature generation tied to wallet authority. In the context of a crypto agent skill, this is especially dangerous because signatures can be exploited to approve asset movement or authenticate harmful actions even without immediate on-chain broadcast.
Content: Scanner excerpt · SKILL.md (reported line 732)May include surrounding context.
bash
# Sign a plain text message curl -X POST "https://api.bankr.bot/agent/sign" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d '{"signatureType": "personal_sign", "message": "Hello, Bankr!"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Typed-data signing is a particularly sensitive operation because EIP-712 payloads are commonly used for token permits, delegated approvals, and marketplace/order authorization. Users can be tricked by natural-language descriptions while the actual typed data grants broad authority to an attacker-controlled spender or protocol.
Content: Scanner excerpt · SKILL.md (reported line 738)May include surrounding context.
md
-d '{"signatureType": "personal_sign", "message": "Hello, Bankr!"}' # Sign EIP-712 typed data (permits, orders) curl -X POST "https://api.bankr.bot/agent/sign" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d '{"signatureType": "eth_signTypedData_v4", "typedData": {...}}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: Transaction signing without broadcasting still creates a fully authorized transaction artifact that can later be submitted elsewhere. In this skill's context, combining natural-language instruction handling with raw transaction signing creates a direct path to unauthorized fund transfers or contract interactions if prompts are manipulated or misunderstood.
Content: Scanner excerpt · SKILL.md (reported line 744)May include surrounding context.
md
-d '{"signatureType": "eth_signTypedData_v4", "typedData": {...}}' # Sign a transaction without broadcasting curl -X POST "https://api.bankr.bot/agent/sign" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d '{"signatureType": "eth_signTransaction", "transaction": {"to": "0x...", "chainId": 8453}}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The /agent/submit endpoint directly broadcasts raw blockchain transactions, which can irreversibly transfer assets or invoke arbitrary contracts. In a skill that supports arbitrary calldata and automated agent workflows, this is highly dangerous because any prompt injection, user confusion, or compromised key can lead to immediate loss of funds.
Content: Scanner excerpt · SKILL.md (reported line 756)May include surrounding context.
bash
# Submit a raw transaction curl -X POST "https://api.bankr.bot/agent/submit" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-workflow.md (reported line 40)May include surrounding context.
Request:

bash
curl -X POST "https://api.bankr.bot/agent/prompt" \ -H "X-API-Key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"prompt": "What is my ETH balance?"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This workflow explicitly documents wallet-affecting operations such as token swaps but does not require an explicit confirmation step or warn about irreversible on-chain effects and financial loss. In a crypto-trading skill, omission of those safeguards can lead downstream agents or integrators to present high-risk actions too casually, increasing the chance of accidental asset transfers or trades.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This reference document presents automation features for limit orders, stop losses, DCA, and TWAP as straightforward commands but does not clearly warn that these are real trading actions that can execute later against live funds. In a crypto trading skill, users may treat examples as low-risk experimentation; missing explicit warnings increases the chance of unintended financial loss, especially because automated orders can trigger when the user is not actively monitoring the account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The scheduled-commands section encourages users to run Bankr commands automatically on a recurring basis without explaining that repeated execution may repeatedly expose portfolio/account information, trigger notifications, or perform recurring actions beyond what the user expects. In a wallet-connected agent, recurring autonomous actions increase the risk of privacy leakage, unwanted transactions, or operational surprises if a command is broad or later interpreted differently.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document discusses transaction failures, slippage, reverted transactions, and funding issues in a crypto-trading context without clearly warning that these actions may execute against real wallets, incur fees, or be irreversible. In an agent skill that can trade, transfer, and sign transactions, this omission increases the chance that users treat examples and recovery steps as low-risk troubleshooting rather than financially consequential operations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/llm-gateway.md (reported line 80)May include surrounding context.
md
## LLM Gateway Setup If the user already has a Bankr account, they just need to configure the gateway. If not, they need to create one first. ### Have Bankr Account

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The documentation states that the setup command writes provider configuration, including the API key, into ~/.openclaw/openclaw.json. Storing long-lived credentials in plaintext config files can expose them via local compromise, backups, source-control mistakes, support uploads, or permissive file permissions, especially because the example says it writes 'with your key and all available models'.
Content: Scanner excerpt · references/llm-gateway.md (reported line 138)May include surrounding context.
Auto-install the Bankr provider into your OpenClaw config:

bash
# Write config to ~/.openclaw/openclaw.json bankr llm setup openclaw --install # Preview the config without writing

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly instructs users to add a long-lived API credential to shell startup files such as ~/.zshrc or ~/.bashrc. Persisting secrets in broadly readable config files increases the chance of accidental disclosure through backups, dotfile sync, screen sharing, support bundles, or local multi-user access, and the text provides no warning or safer alternative.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/llm-gateway.md (reported line 239)May include surrounding context.
The gateway is compatible with standard OpenAI and Anthropic SDKs — just override the base URL.

curl (OpenAI format)

bash
curl -X POST "https://llm.bankr.bot/v1/chat/completions" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The reference presents buy and mint commands as simple natural-language actions without a clear warning that they will spend funds, may incur gas fees, and require verification of collection, price, quantity, and contract details. Because this skill is for live crypto/NFT operations, users may be nudged into irreversible purchases or malicious mint interactions without sufficient friction or disclosure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Direct Prompt Extraction

External Model or Provider Selection

Pass any Claude Code flags through

Missing User Warnings

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

POST /agent/submit

Request Body

Transaction Fields

Missing User Warnings

Vague Triggers

External Transmission

External Transmission

Session Persistence

Autonomous Decision Making

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Session Persistence

Session Persistence

Missing User Warnings

External Transmission

curl (OpenAI format)

Missing User Warnings

Static analysis