Greek Compliance Aade

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:05 PM UTC
• Version: 0.1.2

Overview

The skill is a coherent Greek tax-compliance helper, but it handles sensitive filing authority and includes under-scoped install and submission examples that deserve review before use.

Install only after reviewing the companion skills and pinning trusted versions. Do not expose AADE, EFKA, banking, payroll, or client data to this workflow unless submission credentials are isolated and every government filing is forced through an implemented prepare, review, approve, and submit gate.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:455

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 455–462
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: High

Vulnerable Code

bash

# Core document processing
npx openclaw skills add deepread        # OCR for Greek documents
npx openclaw skills add pdf-tools       # PDF manipulation

# Other Greek accounting skills (install alongside this one)
npx openclaw skills add greek-banking-integration  # Bank statement import for VAT reconciliation
npx openclaw skills add efka-api-integration       # Social security submissions
npx openclaw skills add cli-deadline-monitor       # Deadline alerts for AADE obligations
npx openclaw skills add client-data-management     # Client records and filing history

Technical Analysis

The installation instructions invoke npx openclaw and add six external Skills without pinning package versions, commit hashes, checksums, signatures, or repository identities. Consequently, the components installed when a user follows these instructions may differ from those that existed when this project was audited.

This is particularly significant because the named dependencies are intended to process OCR documents, bank statements, government submissions, deadlines, and client records. Such components could legitimately receive access to sensitive accounting files, payroll information, banking data, and AADE credentials.

The project contains no lockfile, dependency manifest with immutable versions, integrity metadata, or verification procedure that would allow users to establish the provenance of these components. Use of npx may also retrieve and execute package-manager content not included in the audited project.

Attack Path

1. An attacker compromises the upstream package, Skill registry entry, maintainer account, or distribution infrastructure for one of the named dependencies.
2. Alternatively, a similarly named component is ...[truncated 1340 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openclaw and every installed Skill to an audited immutable release, content digest, or commit hash.
2. Document the authoritative registry and source repository for each dependency.
3. Verify package signatures or published checksums before installation.
4. Use a lockfile or equivalent integrity-controlled dependency manifest.
5. Avoid implicit npx retrieval; install a verified CLI version through a controlled deployment process.
6. Review each dependency's requested tools, environment variables, filesystem scope, and network destinations before enabling it.
7. Isolate banking and government-submission integrations using least-privilege service accounts and separate runtime contexts.
8. Do not expose AADE credentials to OCR, PDF, deadline-monitoring, or other components that do not require them.
9. Establish dependency-update review and revocation procedures, including repeat security audits before version changes.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:508

Finding

Submission Examples Bypass the Documented Four-Eyes Approval Sequence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 508–538 and 576–614
Vulnerability Type: Inconsistent authorization workflow for high-impact government submissions
Risk Level: High

Vulnerable Code

The Skill first documents a mandatory approval process:

yaml

Four_Eyes_Workflow:
  step_1_prepare:
    role: "accountant"
    action: "Prepare the filing (VAT return, EFKA declaration, myDATA submission)"
    command: "openclaw greek vat-return --client EL123456789 --period 2026-01 --prepare"
    output: "Draft filing saved to /data/processing/compliance/ with status: prepared"
    
  step_2_review:
    role: "senior_accountant"
    action: "Review the prepared filing — verify figures, check for anomalies"
    command: "openclaw greek review-filing --afm EL123456789 --period 2026-01 --type vat"
    output: "Filing displayed with summary, comparison to prior period, and anomaly flags"
    
  step_3_approve:
    role: "senior_accountant"
    action: "Explicitly approve the filing for submission"
    command: "openclaw greek approve-filing --afm EL123456789 --period 2026-01 --type vat --approved-by m.papadopoulou"
    output: "Filing status changed to: approved. Approval logged to audit trail."
    
  step_4_submit:
    role: "senior_accountant"
    action: "Submit the approved filing to the government system"
    command: "openclaw greek submit-filing --afm EL123456789 --period 2026-01 --type vat"
    gate: "System verifies filing has approval record before allowing submission"
    output: "Filing submitted. Confirmation receipt stored. Status: submitted."
    
  enforcement:
    - "A filing with status 'prepared' cannot be submitted — it must be 'approved' first"
    - "The preparer and approver must be different users"

However, later examples instruct users to proceed directly from preparation or processing to submission:

markdown

Command: openclaw comp
...[truncated 3916 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every direct-submit example with the complete prepare, review, approve, and submit sequence.
2. Make submission a fail-closed operation enforced by the implementation at the network boundary, not merely by Skill instructions.
3. Require authenticated identities for the preparer and approver, and reject approval when they are the same principal.
4. Bind approval cryptographically or by immutable identifier to the exact filing content, client, filing type, period, and content hash.
5. Invalidate prior approval whenever source data or generated XML changes.
6. Require a short-lived, single-use approval token for submission.
7. Separate preparation commands from network-capable submission commands and credentials.
8. Change mydata-submit into distinct mydata-prepare, mydata-review, mydata-approve, and mydata-submit stages.
9. Record immutable audit events for preparation, review, approval, submission, rejection, modification, and emergency override.
10. Add automated tests proving that prepared, modified, expired, self-approved, or otherwise unapproved filings cannot be transmitted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

export AADE_PASSWORD="your-aade-password"

# 3. Ensure dependencies
which jq curl || sudo apt install jq curl

# 4. Create compliance directories
mkdir -p $OPENCLAW_DATA_DIR/compliance/{vat,efka,mydata,e1,e3}

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON file encodes natural-language behavior that forces a specific locale and regulatory context throughout multiple prompts, such as Greek VAT, EFKA, AADE, TAXIS, and Greek-compliant output. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy concern, and no opt-in or alternative locale is offered in the file.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The setup step instructs users to run sudo apt install jq curl if the binaries are missing. Even though the command itself is common administration practice, embedding privileged execution in skill instructions creates a path for elevated changes on the host and normalizes running setup actions with root in a document that also references external tooling and network-connected components.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

export AADE_PASSWORD="your-aade-password"

# 3. Ensure dependencies
which jq curl || sudo apt install jq curl

# 4. Create compliance directories
mkdir -p $OPENCLAW_DATA_DIR/compliance/{vat,efka,mydata,e1,e3}

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx openclaw ... without pinning a specific package version. npx may fetch and execute the latest published package or a compromised dependency at runtime, creating a supply-chain execution path inside a high-trust accounting/compliance workflow that may access tax data and credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This unpinned npx openclaw command can cause arbitrary code execution from whatever package version is resolved at the time of use. In a skill designed for government filings and payroll processing, that increases exposure because the executed tool may handle sensitive financial records and authentication material.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Referencing npx openclaw without version pinning leaves package resolution non-deterministic and vulnerable to upstream compromise, typosquatting, or malicious updates. Because this skill chains multiple accounting-related skills together, one compromised fetch could subvert the broader compliance environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

An unpinned npx command is a real supply-chain risk because it delegates trust to the current state of the package registry at runtime. In this context, a malicious package could exfiltrate accounting files, employee payroll data, or portal credentials while appearing to perform normal compliance functions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The command relies on npx without an explicit version, which can unexpectedly execute altered upstream code. Since the skill is intended to integrate with tax, banking, and compliance workflows, compromise here could affect both confidentiality and integrity of regulated submissions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This is another instance of unpinned remote package execution through npx, which is especially risky in an environment that may process government filing artifacts and business records. The repeated pattern suggests insecure installation guidance rather than a one-off mistake, increasing operational risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.