Friday Budgeting Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:06 AM UTC
• Version: 1.0.7

Overview

This personal finance skill is mostly coherent, but it needs Review because it handles bank data and credentials with broad persistent access and some under-scoped disclosure paths.

Review this carefully before installing. It is a real local finance tool, but installation grants a persistent daemon access to bank transaction data, Plaid credentials, OpenClaw credential files, and LLM providers. Only install if you accept external LLM classification fallback, plaintext storage of Plaid developer credentials, and system-level Python/package and launchd changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: server/classifier.py:466

Finding

Automatic Disclosure of Detailed Financial Data to External LLM Providers

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: server/llm.py:89

Finding

Unauthorized Discovery and Use of Host Agent Credentials

Content

View full analysis

dict: """Return the parsed ~/.openclaw/openclaw.json (cached).""" global _openclaw_config_cache if _openclaw_config_cache is None: try: _openclaw_config_cache = json.loads(_OPENCLAW_CONFIG_PATH.read_text()) except Exception: _openclaw_config_cache = {} return _openclaw_config_cache def _load_openclaw_auth() -> dict: """Return the parsed auth-profiles.json (cached).""" global _openclaw_auth_cache if _openclaw_auth_cache is None: try: _openclaw_auth_cache = json.loads(_OPENCLAW_AUTH_PROFILES_PATH.read_text()) except Exception: _openclaw_auth_cache = {} return _openclaw_auth_cache ``` ```python # server/llm.py:134-148 def _openclaw_gateway_token() -> str: """Return the OpenClaw gateway Bearer token, auto-discovered from openclaw.json.""" token = os.environ.get("OPENCLAW_GATEWAY_TOKEN", "") if token: return token cfg = _load_openclaw_config() return cfg.get("gateway", {}).get("auth", {}).get("token", "") def _anthropic_api_key_from_openclaw() -> str: auth = _load_openclaw_auth() return auth.get("profiles", {}).get("anthropic:default", {}).get("key", "") ``` ### Technical Analysis The Skill directly reads the host Agent's general configuration and authentication-profile files. It extracts an OpenClaw gateway bearer token and an Anthropic API key that were not provisioned specifically to this Skill. This crosses an application boundary: inst ...[truncated 1664 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: server/main.py:2674

Finding

Plaid API Secret Persisted in Plaintext in Both SQLite and a Dotenv File

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Dependencies Installed Directly into System Python

Content

View full analysis

=41.0 keyring>=24.0 plaid-python>=14.0 fastapi>=0.110 uvicorn>=0.29 openpyxl>=3.1 jinja2>=3.0 python-multipart>=0.0.7 argon2-cffi>=23.1 python-dotenv>=1.0 pytest>=7.0 httpx>=0.27 ``` ### Technical Analysis The installation command bypasses Python's externally managed environment protection with `--break-system-packages`. Dependencies are either completely unpinned or constrained only by a minimum version, and no package hashes are supplied. Consequently, the code actually installed can change after the Skill has been reviewed. A newly published dependency version satisfying these broad constraints may be selected automatically. Python packages can execute build-backend or installation-related code during installation, and the installed runtime code executes with the same user privileges as the persistent daemon. Including test-only packages such as `pytest` and `httpx` in the production installation further increases attack surface. ### Attack Path 1. The user installs the Skill. 2. The installer invokes the system `pip3` with `--break-system-packages`. 3. Pip resolves current package versions from its configured package index. 4. A compromised maintainer account, malicious release, dependency takeover, or future vulnerable version satisfies the unconstrained or lower-bounded requirement. 5. Pip downloads and installs that release. 6. Malicious build or runtime code executes under the user's account. 7. Because the Skill daemon persists, the compromised dependency may continue to access financial data, Plaid credentials, Keychain-ba ...[truncated 531 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: server/installer.py:77

Finding

Installer Can Destroy Existing OpenClaw Configuration on Read or Parse Failure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (463)

Tainted flow: 'req' from os.environ.get (line 64, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The notification endpoint is taken directly from the OPENCLAW_NOTIFY_URL environment variable and then used for an outbound POST without allowlisting or verification. If an attacker can influence the process environment, they can redirect notification contents to an arbitrary host, causing data exfiltration or unintended internal network access.

Content

Scanner excerpt · server/notify.py (reported line 71)May include surrounding context.

python

method="POST",
    )
    try:
        with request.urlopen(req, timeout=5) as resp:
            return resp.status < 400
    except (URLError, OSError):
        return False

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The design includes sending finance-related notifications and classification questions through OpenClaw chat, which can leak sensitive transaction context into a broader messaging substrate outside the local budgeting daemon. Because the product is explicitly positioned as a personal-finance assistant, chat notifications can expose private spending details through external channels, logs, integrations, or less-trusted client surfaces.

Content

Scanner excerpt · ARCHITECTURE.md (reported line 759)May include surrounding context.

md

- **First-run flow:** when the UI sees that `app_config.ui_password_hash`
  is empty, every route except `/setup` redirects there. The `/setup`
  wizard collects: new password, confirm password, optional notification
  preference ("send chat notifications via OpenClaw if available"), then
  prompts to connect a first bank.
- **Password storage:** argon2id hash in `app_config.ui_password_hash`.
  Never sent back to the browser.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · FIXES.md (reported line 120)May include surrounding context.

md

| Component | Before | After |
|---|---|---|
| `plaid_config` table | Existed in schema | Unchanged — already correct |
| Access token encryption | Fernet key in macOS Keychain (stable) | Unchanged — already correct |
| Access tokens in DB | Stored encrypted in `bank_connections` | Unchanged — already correct |
| `configure_plaid()` → DB write | Present but crashed on uninit DB in tests | Wrapped in `try/except`; gracefully skips if DB not ready |
| Daemon startup | Only loaded `.env`; no DB credential loading | Adds `_load_plaid_config_from_db()` step after `init_db` |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · FIXES.md (reported line 121)May include surrounding context.

md

|---|---|---|
| `plaid_config` table | Existed in schema | Unchanged — already correct |
| Access token encryption | Fernet key in macOS Keychain (stable) | Unchanged — already correct |
| Access tokens in DB | Stored encrypted in `bank_connections` | Unchanged — already correct |
| `configure_plaid()` → DB write | Present but crashed on uninit DB in tests | Wrapped in `try/except`; gracefully skips if DB not ready |
| Daemon startup | Only loaded `.env`; no DB credential loading | Adds `_load_plaid_config_from_db()` step after `init_db` |
| `health_monitor` | Created per-connection providers, ignoring `plaid_provider` arg | Uses passed `plaid_provider` when not None; only creates per-connection providers when called standalone |

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README instructs users to hand Plaid Client ID and Secret directly to an AI agent without a strong warning about secret handling risks. This encourages users to disclose sensitive credentials into a conversational channel that may be logged, retained by the host agent, or exposed to other tools/prompts, expanding the trust boundary unnecessarily.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This explicitly tells the user to provide Plaid credentials to an AI agent, which is a direct secret-disclosure pattern. Even if the app is local-only, the agent/client ecosystem may log messages, sync transcripts, or expose prompt content to other components, making credential compromise more likely.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding notes that Plaid credentials are written to a local .env file and process environment variables are modified. In a banking application, persisting API credentials in a plaintext environment file materially increases the risk of credential disclosure through local compromise, backups, logs, or accidental inclusion in support bundles, and the skill's own guidance says credentials should not be stored in plain text.

Content

No source excerpt is available for this finding.