Greek Banking Integration

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:33 PM UTC
• Version: 0.1.0

Overview

This looks like a legitimate Greek bank statement processing skill, but it should be reviewed because it handles sensitive financial data and includes optional accounting updates and Xero pushes without enough control details.

Review this before installing in any real accounting environment. Use it only in a controlled workspace, keep bank statements and exports access-restricted, avoid configuring XERO_API_KEY unless direct external submission is intended, and require human review before any auto-update, scheduled processing, or accounting-system write operation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq
mkdir -p $OPENCLAW_DATA_DIR/banking/imports/{alpha,nbg,eurobank,piraeus}
```

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The expectation explicitly requires generating a report in a professional Greek format, which imposes a specific language requirement. Because this is framed as a requirement rather than an optional locale setting or justified region-specific constraint, it may violate language-choice policy.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The expectation says the management report is created in Greek, but the file does not indicate that users can choose another language. This creates a natural-language locale constraint that is not presented as optional or explicitly justified in the requirement text.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest and metadata frame the skill as a file-based bank statement parser, but the same section adds optional direct Xero API push and broader integration behavior. This scope expansion is security-relevant because it changes the trust boundary from local file processing to outbound third-party data transfer and cross-system actions without making that risk explicit.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Introducing XERO_API_KEY and direct Xero push extends the skill beyond passive file import into active external transmission of financial records. For a banking/accounting skill handling sensitive transaction data, undocumented or underemphasized outbound API behavior increases risk of unintended disclosure or misuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill handles highly sensitive financial and accounting information and can export results to files and optional third-party systems, yet it lacks a clear privacy/security warning. This omission may lead users to store, process, or transmit regulated financial data without adequate safeguards or awareness.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq
mkdir -p $OPENCLAW_DATA_DIR/banking/imports/{alpha,nbg,eurobank,piraeus}
```

• Confidence: 93% confidence
• Finding: The setup instructions include sudo apt install jq, encouraging privilege escalation during skill setup. In a skill-processing context, normalizing root-level package installation increases the blast radius of mistakes, dependency confusion, or operator copy-paste execution on production systems.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The document says no bank API credentials are required and emphasizes manual file exports, but later advertises orchestration, direct accounting updates, and optional API push. That mismatch can cause operators to underestimate the skill's ability to move or modify sensitive accounting data across systems.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: Claiming a file-based/no-credentials model while later supporting direct Xero API push creates a misleading security posture. Users may deploy the skill assuming only local processing, when it can also perform external transmission of bank-derived accounting data.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The skill repeatedly frames outputs and behavior as Greek-specific and includes commands such as '--greek-locale' and Greek-only formatting assumptions, but does not clearly present locale selection as an explicit user choice. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified.

Static analysis

No suspicious patterns detected.