Firm Fintech Pack

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:12 AM UTC
• Version: 1.0.0

Overview

This fintech skill is mostly a static orchestration guide, but it asks for broad multi-session authority and recommends mutable network installs in a sensitive financial context.

Review this skill before installing in a financial environment. Only grant session history, session sending, and session spawning where there is explicit user approval, tenant isolation, redaction of customer and financial data, and audit logging. Avoid running the `npx ...@latest` companion install commands in production; use pinned, reviewed versions or an internal approved registry.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48
• Finding: Mutable Third-Party Packages and Skills Installed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48–56 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash ## Recommended ClawHub skills to install alongside ```bash npx clawhub@latest install biz-reporter # Financial KPI reporting npx clawhub@latest install arc-security-audit # SOC 2 / PCI-DSS audit npx clawhub@latest install agent-audit-trail # Tamper-evident transaction logs npx clawhub@latest install arc-trust-verifier # Counterparty verification npx clawhub@latest install firm-orchestration # A2A orchestration backbone npx clawhub@latest install firm-delivery-export # Output → report / ticket ``` ``` ### Technical Analysis The documented commands invoke `npx clawhub@latest`, which resolves and executes a mutable version of the `clawhub` package. They then install six additional skills without pinned versions, integrity hashes, signature requirements, or references to reviewed source revisions. Consequently, the code executed by these commands can differ from the content available when this project was audited. A registry compromise, maintainer-account compromise, malicious package update, dependency confusion event, or compromise of one of the recommended skills could introduce attacker-controlled behavior. These commands are recommendations rather than an automatic installation routine, so exploitation requires a user or agent to follow the documented instructions. ### Attack Path 1. An attacker compromises the `clawhub` package, its distribution channel, a transitive dependency, or one of the six recommended skills. 2. The attacker publishes a modified version under the mutable version or skill identifier referenced by the documentation. 3. A user follows the documented `npx clawhub@latest install ...` instructions. 4. `npx` downloads and executes the currently resolved package under the invoking user's privileges. 5. The compromise ...[truncated 864 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version of the CLI. 2. Pin exact versions or immutable revisions for every recommended skill. 3. Record and verify package integrity hashes or cryptographic signatures before installation. 4. Use a trusted registry with namespace controls, package provenance, and mandatory multifactor authentication for publishers. 5. Review each skill and its transitive dependencies before recommending installation. 6. Execute installation in an isolated, least-privileged environment without production credentials or sensitive financial data. 7. Generate and retain a lockfile or equivalent dependency manifest. 8. Add an explicit user-confirmation step describing the external code that will be downloaded and executed. 9. Continuously monitor pinned dependencies for compromise and security advisories rather than automatically adopting new releases. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:14
• Finding: Overbroad Session Management Capabilities Declared Without Demonstrated Need<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14–20 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: openclaw: requires: env: [] bins: [] tools: - sessions_send - sessions_spawn - sessions_history primaryEnv: "" ``` ### Technical Analysis The skill declares access to session-message transmission, subordinate-session creation, and session-history retrieval. The project contains only the `SKILL.md` configuration and prompt examples; it does not provide a local implementation demonstrating why every declared session capability is necessary. In particular, `sessions_history` may expose information from agent sessions, while `sessions_send` may transmit information to another session and `sessions_spawn` may create additional execution contexts. Granting all three capabilities increases the privilege and data-exposure surface of this otherwise static sector bundle. This declaration is not proof that session data is automatically accessed. Exploitation depends on the runtime granting the listed tools and on this skill, an associated orchestration component, or a compromised dependency invoking them. ### Attack Path 1. The skill is installed or activated in a runtime that grants the tools declared in its metadata. 2. A malicious or compromised companion skill, orchestration instruction, or injected workflow causes one of the declared session tools to be invoked. 3. `sessions_history` is used to retrieve accessible prior-session content, or `sessions_spawn` creates a secondary execution context. 4. `sessions_send` transmits retrieved data or attacker-selected instructions to another accessible session. 5. Information may cross the boundary of the immediate task, or additional agents may operate with capabilities inherited from the runtime. ### Impact Assessment The potential scope includes session content ...[truncated 548 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every session tool that is not essential to a documented workflow. 2. Avoid granting `sessions_history` by default; request it only for a specific session and explicit user-approved purpose. 3. Scope `sessions_send` to an allowlist of destination session identifiers. 4. Require explicit user confirmation before spawning an agent, reading history, or sending content across session boundaries. 5. Prevent spawned sessions from inheriting tools or sensitive context unless individually authorized. 6. Apply strict tenant, user, and workspace isolation to all session operations. 7. Redact financial, customer, credential, and regulatory data before transferring content between sessions. 8. Maintain immutable audit records identifying the requesting skill, operation, source session, destination session, and authorization decision. 9. Document the legitimate purpose of each retained tool in the skill and test that denied or out-of-scope session access fails securely. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The description says the bundle 'Activates the firm pyramid' with multiple agents, but it does not specify the exact trigger phrases, invocation conditions, or any exclusion criteria. For a markdown/manifest file, this is overly vague and could cause unintended activation in broad fintech-related contexts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill recommends installing tooling via `npx clawhub@latest`, which pulls the latest package version at execution time rather than a reviewed, fixed version. In a security-sensitive fintech context, this creates supply-chain risk: a compromised upstream release or unexpected breaking change could alter what gets installed and executed without notice.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: This line repeats the use of `npx clawhub@latest`, causing the same unpinned remote package execution risk. Because the skill is aimed at fintech operations involving compliance and payment infrastructure, installing mutable dependencies from the network increases the chance of introducing malicious or unreviewed code into sensitive workflows.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: Using `npx clawhub@latest` here means the installed tool is not reproducible and may differ over time. In regulated financial environments, that undermines change control and can expose users to package compromise, typosquatting-like replacement, or silent behavioral changes in an orchestration component.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The command on this line instructs users to fetch and run the latest `clawhub` package dynamically. That is dangerous because the package contents can change after the skill is published, turning documentation into an execution path for untrusted code, especially risky where transaction logs and counterparty verification are involved.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: This recommendation again relies on `npx clawhub@latest`, exposing users to mutable third-party code execution. Given the skill bundle activates multiple departments and orchestration capabilities, a compromised installer could affect broad workflows or expose sensitive fintech data paths.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: This line has the same supply-chain weakness: `@latest` causes non-deterministic package retrieval and execution. In a fintech skill that explicitly references audit trails and reporting/export functions, compromise of the installer or package could impact confidentiality, integrity, and compliance evidence generation.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The support section switches to French ('Si ce skill vous est utile...') even though the rest of the file is in English, and there is no opt-in or explanation for the language choice. This can violate language/locale policy expectations when a skill imposes a language without user choice.

Static analysis

No suspicious patterns detected.