Security audit

Finance Skill

Security checks for vulnerabilities and agentic risk

Overview

This finance skill is purpose-aligned, but it needs Review because it persistently stores sensitive bank data without strong local protection or clear confirmation controls.

Install only if you are comfortable storing bank statements and transaction history locally in the OpenClaw workspace. Before using it, consider tightening permissions on ~/.openclaw/workspace/finance, avoiding raw statement retention unless needed, and requiring confirmation before the agent adds manual transactions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/add-transactions.sh:5
Finding: Sensitive Financial Records Created Without Restrictive Permissions
Content: View full analysis
"$STORE" fi ``` ### Technical Analysis The script stores transaction dates, merchant names, monetary amounts, categories, source documents, and account metadata in a local JSON file. It does not establish a restrictive `umask` or explicitly set permissions on the finance directories and transaction file. Consequently, permissions depend entirely on the invoking process's environment. With a common `umask` of `022`, directories can be created as `0755` and the transaction file as `0644`. This may permit other local users to traverse the finance directories and read the financial records. The script also does not verify that existing storage paths are owned by the current user or that they are not symbolic links. ### Attack Path 1. A user invokes `add-transactions.sh` to import financial transactions. 2. The script creates the finance directories and `transactions.json` using the caller's default `umask`. 3. The resulting file is created with permissions that may allow access by other local users. 4. Another local account or process reads `~/.openclaw/workspace/finance/transactions.json`. 5. The attacker obtains the user's transaction history and any stored account metadata. ### Impact Assessment A local attacker may disclose sensitive financial information, including spending amounts, merchants, dates, categories, statement source names, and account details. The issue does not directly grant elevated system privileges, but it compromises the confidentiality of all fin ...[truncated 190 chars]
Remediation: View remediation
"$STORE" fi chmod 600 "$STORE" ``` 4. Before reading or replacing existing paths, verify that they: - Are owned by the effective user. - Are regular files or directories of the expected type. - Are not symbolic links. - Are not writable by group or other users. 5. Fail securely if the ownership or permissions do not meet these requirements. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/add-transactions.sh:19
Finding: Predictable Temporary File Enables Symlink-Based File Clobbering
Content: View full analysis
"${STORE}.tmp" && mv "${STORE}.tmp" "$STORE" ``` ### Technical Analysis The script writes updated transaction data to the fixed path `transactions.json.tmp`. Shell output redirection opens this path before `jq` executes and follows symbolic links by default. If an attacker can create or replace entries in the finance directory, the attacker can place a symbolic link at `${STORE}.tmp` that points to another file writable by the user running the script. When the script runs, redirection follows the link and truncates or overwrites the target with generated JSON data. The subsequent `mv` does not prevent the initial overwrite. The weakness is amplified if the finance directory has inappropriate permissions or is located in an environment where another process operating under the same account is untrusted. ### Attack Path 1. The attacker obtains the ability to create or replace files in `~/.openclaw/workspace/finance/`. 2. The attacker creates a symbolic link named `transactions.json.tmp` pointing to a target file writable by the victim. 3. The victim runs `add-transactions.sh`. 4. The shell follows the symbolic link while processing the output redirection. 5. The target file is truncated and overwritten with the output from `jq`. 6. The final `mv` may replace the transaction store with the symlink entry or otherwise leave the store corrupted. ### Impact Assessment The attacker can overwrite or corrupt files writable by the account invoking the script. The affected scope is bounded by that account's existing filesystem ...[truncated 369 chars]
Remediation: View remediation
"$TMP_FILE" || exit 1 chmod 600 "$TMP_FILE" mv -f -- "$TMP_FILE" "$STORE" || exit 1 trap - EXIT HUP INT TERM ``` 3. Validate that the existing store is a regular file owned by the invoking user and reject symbolic links. 4. Keep the temporary file on the same filesystem as the destination so that the final rename remains atomic. 5. Add error handling so failed writes do not leave stale temporary files or a partially updated store. ]]>

T08 · Insecure Dependencies

Note

Location: SKILL.md:91
Finding: Unpinned Third-Party Python Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Generate and enforce cryptographic hashes: ```text pypdf== \ --hash=sha256: ``` Install it with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Install dependencies in a dedicated virtual environment rather than the system Python environment. 4. Commit the reviewed dependency manifest to the project and update both `SKILL.md` and `README.md` to reference it. 5. Periodically review pinned versions for security advisories and update pins and hashes through a controlled process. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to persist highly sensitive financial records, including statements and transaction history, under a workspace path without any explicit warning, consent flow, retention policy, or privacy controls. Because financial data is particularly sensitive, silent persistence increases the risk of unintended long-term storage, overcollection, local disclosure to other tools or users on the system, and user surprise about where their data is being kept.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README explicitly states that original bank statements and transaction history are retained on disk, but it does not warn users about the sensitivity, persistence, or local compromise risks of storing financial records unencrypted. In the context of a finance skill, this increases exposure to privacy loss and secondary compromise if the host, backups, shared account, or workspace permissions are weak.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction to treat a casual natural-language statement like "I spent $X at Y" as a direct write operation to persistent storage is overly broad and can misfire on hypothetical, quoted, historical, or exploratory conversation. In a finance skill, that creates integrity risks by silently recording false transactions, which can corrupt spending history and downstream answers.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.