Dashboard Greek Accounting

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:34 PM UTC
• Version: 0.1.0

Overview

The dashboard’s purpose is coherent, but its install path pulls mutable unpinned OpenClaw packages and dependencies before working with sensitive accounting data.

Review this skill before installing in a real firm environment. Pin the OpenClaw CLI and every skill dependency to reviewed versions, avoid running install commands with unnecessary privileges, install `jq` through your normal admin process, and only enable email/slack/sms delivery after recipient allowlists, credential isolation, audit logging, and client access controls are configured.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:739

Finding

Unpinned Package Execution and Recursive Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 739–759
Vulnerability Type: Unpinned third-party dependencies and unsafe transitive installation
Risk Level: Medium

Vulnerable Code

yaml

Required_Skills:
  core_dependencies:
    - accounting-workflows
    - greek-compliance-aade
    - cli-deadline-monitor
    - greek-email-processor
    - greek-individual-taxes
    - openclaw-greek-accounting-meta

  advanced_dependencies:
    - aade-api-monitor
    - greek-banking-integration
    - greek-document-ocr
    - efka-api-integration

  openclaw_core:
    - file-processor
    - deepread
    - doc-converter

Installation_Command:
  setup: "npx openclaw skills add dashboard-greek-accounting --install-deps"
  verification: "openclaw dashboard health-check --verify-all-integrations"

Technical Analysis

The installation command invokes npx openclaw without pinning the package to a reviewed version or integrity hash. Depending on the local npm environment, npx may retrieve and execute the currently resolved package from the configured registry. The effective installer can therefore change after this Skill has been reviewed.

The --install-deps option also recursively installs multiple Skills whose versions, source repositories, and integrity values are not specified. Those components are not included in the audited project, so their behavior cannot be verified from the available files.

This creates a supply-chain trust boundary in which the installation process depends on mutable registry content and unaudited transitive components. The audit found no evidence that the currently documented package or dependencies are malicious; the risk arises from the absence of immutable dependency controls.

Attack Path

1. An attacker compromises a future release of the openclaw npm package, one of its transitive dependencies, or one of the named Skill dependencies.
2. Alternatively, dependency resolution is redirected through a compro ...[truncated 1450 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an explicitly reviewed version:

   bash

   npx --yes openclaw@<reviewed-version> skills add dashboard-greek-accounting
   

2. Record and verify package integrity using a lockfile, checksums, or registry integrity metadata.

3. Replace --install-deps with an explicit dependency manifest that pins every Skill to an immutable version, commit, or content digest.

4. Document trusted registries and source repositories. Reject dependency resolution from unapproved registries or mutable branches.

5. Review every transitive Skill before installation and maintain an allowlist of approved package names, versions, publishers, and hashes.

6. Disable npm lifecycle scripts where operationally possible, or perform installation in a restricted sandbox before deployment.

7. Run installation as a dedicated, non-privileged account with no unnecessary access to production accounting data or notification credentials.

8. Separate installation from runtime credential provisioning so package installation processes cannot inherit SMTP_PASSWORD, webhook URLs, or similar secrets.

9. Generate and retain a software bill of materials for the CLI, its npm dependency graph, and all installed Skills.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash

export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq

No external credentials required. Generates text-based dashboard reports by reading data from local files in OPENCLAW_DATA_DIR.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The eval prompts authorize broad operational behavior such as aggregating across all clients, force-refreshing integrated systems, rebuilding cache, and writing alert rules without explicit guardrails, scope limits, or approval conditions. In a business-intelligence skill handling accounting and compliance data, this can lead to overbroad data access, unintended state-changing actions, and misuse of administrative functions when prompts are interpreted too permissively.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description states that the skill provides an English-language business intelligence interface for managing Greek clients, and later sections reinforce English-only dashboard views. This is a language policy constraint presented as mandatory behavior, with no indication that users may choose another language or opt in to English specifically.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The setup instructions tell users to run sudo apt install jq, encouraging privilege elevation during installation. Even though installing a package manager dependency is common, embedding sudo in skill instructions expands the blast radius if users copy commands blindly, especially in environments where skill content is treated as trusted automation guidance.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash

export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq

No external credentials required. Generates text-based dashboard reports by reading data from local files in OPENCLAW_DATA_DIR.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The bullet point 'English Interface, Greek Data' specifies the dashboard language as English as a built-in design rule. Because no alternate language option or opt-in is offered in the surrounding documentation, this appears to force a language/locale choice on users.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The installation command uses npx openclaw without pinning an exact package version, which can cause the skill to execute a newer or compromised package unexpectedly. In a skill ecosystem that coordinates reporting, alerting, and access to accounting data, supply-chain drift increases the risk of unintended code execution or behavior changes during install or runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes automatic emailing of daily summary reports that may contain client compliance, financial, and deadline data, but does not include any warning, approval step, recipient validation, or data-minimization guidance. This creates a realistic risk of accidental disclosure of sensitive client information to unintended recipients or through insecure email handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The expectation explicitly requires the information to be 'presented all information in English,' which imposes a language choice without indicating user preference, opt-in, or a justified locale restriction. This can violate language or locale policy when the skill does not offer the user a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file requires the end-of-day summary to be 'formatted as a clear English summary suitable for handoff,' which hard-codes a language requirement without user opt-in or a documented locale justification. This is a natural-language policy concern even though it appears in evaluation expectations rather than executable code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.