Bankroll Manager — Cross-Platform P&L Tracker

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:17 AM UTC
• Version: 1.1.0

Overview

This skill is betting-focused and mostly coherent, but it should be reviewed because it stores sensitive betting data and gives an unsafe raw SQLite shell command for user-entered values.

Review before installing. Use this only for betting bankroll tracking, avoid putting private details in notes, and do not let it run the shown sqlite3 command with untrusted or unsanitized text. A safer version should use parameterized database writes and document how to delete or export stored records.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31

Finding

Unsafe User-Value Interpolation Enables SQL and Shell Command Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-35
Vulnerability Type: SQL injection and shell command injection
Risk Level: High

Vulnerable Code

bash

sqlite3 ~/.openclaw/data/bankroll.db \
  "INSERT INTO bets (platform, sport, selection, bet_type, stake, odds, notes)
   VALUES ('PLATFORM', 'SPORT_KEY', 'SELECTION', 'BET_TYPE', STAKE, ODDS, 'NOTES');"

Technical Analysis

The skill instructs the agent to replace uppercase placeholders directly within an SQL statement that is itself embedded in a double-quoted shell argument. No parameter binding, shell-safe argument handling, escaping, or input validation is specified.

Text fields such as PLATFORM, SELECTION, and NOTES are enclosed in SQL single quotes. An attacker-controlled apostrophe can terminate the intended SQL string and append additional SQL statements or alter the original query. The numeric STAKE and ODDS fields are inserted without quoting or type validation, providing additional SQL injection opportunities.

The SQL statement is also placed inside shell double quotes. If substituted content contains shell expansion syntax such as command substitution, the shell can evaluate it before invoking sqlite3. Merely escaping SQL single quotes would therefore not address the shell-injection layer.

Attack Path

1. An attacker or untrusted user asks the agent to log a bet containing crafted data in a platform, selection, notes, stake, or odds field.
2. Following the skill instructions, the agent replaces the uppercase placeholder with that value verbatim.
3. A value containing an SQL quote and additional syntax escapes the intended SQL literal, allowing unauthorized statements to be interpreted by SQLite.
4. Alternatively, a value containing shell command-substitution syntax is placed inside the generated double-quoted shell argument.
5. The shell evaluates that substitution before starting sqlite3, executing the ...[truncated 1022 chars]

Remediation

View remediation

Remediation Suggestions

• Replace generated shell SQL with a dedicated implementation using Python's sqlite3 API and parameterized queries:

  python

  connection.execute(
      """
      INSERT INTO bets
          (platform, sport, selection, bet_type, stake, odds, notes)
      VALUES (?, ?, ?, ?, ?, ?, ?)
      """,
      (platform, sport, selection, bet_type, stake, odds, notes),
  )
  

• Pass values as data through a structured interface instead of constructing a shell command from user-controlled text.

• Do not use shell=True, shell-generated command strings, eval, or equivalent mechanisms.

• Validate stake and odds as finite numeric values and enforce documented minimum and maximum bounds.

• Restrict fields such as platform, sport, and bet type to explicit allowlists where practical.

• Apply length limits and reject control characters for free-text fields.

• Execute database operations with the least-privileged operating-system account and restrictive database-file permissions.

• Use transactions and handle database errors without retrying through dynamically modified commands.

• Add tests containing apostrophes, quotes, command-substitution characters, SQL metacharacters, and unusually long input.

• Correct and close the Markdown code fence, and provide schema initialization or migration instructions for the required bets table.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description is broad enough to trigger on generic money-management requests, which can cause the agent to invoke betting-specific functionality in contexts the user did not intend. In a financial domain, overbroad activation increases the chance of inappropriate tool use, accidental persistence, or advice being framed as bankroll management when the user only wanted general budgeting help.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation instructs persistent storage of betting data in a local SQLite database but does not clearly warn the user that sensitive financial and behavioral data will be retained on disk. In this context, bet history, platform names, stakes, and notes may reveal private financial activity, so silent persistence creates privacy and consent risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The invocation guidance lists many cases where the skill should be used but does not define when it should not be used, leaving activation boundaries ambiguous. That ambiguity can lead to the skill being selected for adjacent financial conversations and performing actions or giving domain-specific guidance outside its intended betting context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.