Openclaw Greek Accounting Meta

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:53 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent Greek accounting orchestrator, but it documents broad financial/government actions with weak authorization and installation controls that need review before use.

Install only in a restricted accounting environment after pinning package and skill versions, avoiding routine sudo use, validating AFM/month/user inputs, making authorization fail closed, and requiring explicit authenticated confirmation for filings, communications, client changes, and bulk document movement.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:239

Finding

Command Injection Through Unescaped Workflow Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 239–304
Vulnerability Type: Command injection through string-based command construction
Risk Level: High

Vulnerable Code

python

self.call_skill('auth', f'check-access --username {user} --client {afm} --action compliance_management')

client = self.call_skill('clients', f'view --afm {afm} --compliance-summary')

deadlines = self.call_skill('monitoring', f'check aade --client {afm}')

self.call_skill('banking', f'reconcile --afm {afm} --period {month}')

vat = self.call_skill('compliance', f'vat-return --client {afm} --period {month} --prepare')
efka = self.call_skill('efka', f'contribution-calc --afm {afm} --period {month}')

python

def call_skill(self, skill_type, command):
    """Execute command on specific skill with error handling"""
    skill_name = self.skills[skill_type]
    try:
        result = openclaw_execute(f"openclaw skills use {skill_name} {command}")
        return result
    except Exception as e:
        self.handle_skill_error(skill_name, command, e)
        return self.get_fallback_result(skill_type)

Technical Analysis

Workflow parameters such as user, afm, and month are inserted directly into command strings using Python formatted-string interpolation. The resulting string is passed to openclaw_execute without visible validation, escaping, or separation into a fixed executable and an argument array.

If openclaw_execute invokes a command shell, an attacker-controlled parameter containing shell metacharacters, command substitutions, redirections, or additional command-line tokens could alter the intended command. Even if no shell is used, unrestricted additional arguments may still manipulate the downstream OpenClaw command.

The documented AFM and period formats are not enforced by the shown implementation. Expected constraints such as EL followed by nine digits and a strict `YYYY-MM ...[truncated 1419 chars]

Remediation

View remediation

Remediation Suggestions

• Replace string-based execution with an API that accepts a fixed executable and an argument array, with shell processing explicitly disabled.
• Validate each parameter before dispatch:
  • AFM: ^EL[0-9]{9}$
  • Period: a strict YYYY-MM value with a valid month
  • Username: an explicit allowlist of permitted characters and bounded length
• Reject values beginning with option prefixes or containing whitespace, control characters, shell metacharacters, or path separators unless explicitly required.
• Do not rely exclusively on quoting or escaping; structured argument passing should be the primary control.
• Define typed command objects rather than allowing arbitrary command strings to cross the orchestration boundary.
• Execute delegated skills using a dedicated, least-privileged operating-system account with access only to the required client and workflow data.
• Add tests containing command separators, substitutions, redirections, newlines, and injected options to verify that all such values are rejected.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:239

Finding

Authorization Check Can Fail Open Through Generic Fallback Handling

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 239–308
Vulnerability Type: Fail-open authorization and improper security-error handling
Risk Level: High

Vulnerable Code

python

# Step 1: Permission gate — must pass before any work begins
self.call_skill('auth', f'check-access --username {user} --client {afm} --action compliance_management')

python

# Step 7: HUMAN CONFIRMATION GATE — display details and require explicit YES
self.require_confirmation(
    action='government_submission',
    details={'vat': vat, 'efka': efka, 'client': afm, 'period': month}
)

# Step 8: Submit (only reached after confirmed)
self.call_skill('compliance', f'vat-return --client {afm} --period {month} --submit')
self.call_skill('efka', f'submit-declaration --afm {afm} --period {month}')

python

def call_skill(self, skill_type, command):
    """Execute command on specific skill with error handling"""
    skill_name = self.skills[skill_type]
    try:
        result = openclaw_execute(f"openclaw skills use {skill_name} {command}")
        return result
    except Exception as e:
        self.handle_skill_error(skill_name, command, e)
        return self.get_fallback_result(skill_type)

Technical Analysis

The authorization operation is dispatched through the same generic call_skill function as non-security-critical operations. That function catches every exception and returns a fallback result. The caller does not inspect the authorization response or require an explicit access-granted result before continuing.

Consequently, an unavailable authentication skill, a timeout, malformed response, internal exception, or another execution failure can be converted into a normal return path. The workflow then proceeds to document processing, reconciliation, preparation, and potentially government submission.

The later human-confirmation gate confirms the business action but d ...[truncated 1437 chars]

Remediation

View remediation

Remediation Suggestions

• Make authorization fail closed: authentication exceptions, timeouts, unavailable services, and malformed responses must terminate the workflow.
• Require a typed and cryptographically trustworthy authorization result, such as an explicit allowed == true, before performing any subsequent operation.
• Separate security-critical dispatch from generic fallback handling. Never return cached or synthetic authorization decisions.
• Distinguish authorization denial from infrastructure failure and audit both outcomes.
• Bind the verified principal, client identifier, action, and authorization decision to a short-lived workflow context.
• Revalidate authorization immediately before government submission and other high-impact writes.
• Require downstream skills to enforce authorization independently rather than trusting the orchestrator alone.
• Ensure the person providing human confirmation is authenticated and is the same authorized principal, or has separately verified delegated authority.
• Add negative tests for denied access, authentication timeout, malformed responses, unavailable authentication services, and fallback-result injection.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:77

Finding

Unpinned Package Execution with Automatic Transitive Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 77
Vulnerability Type: Unpinned executable dependency and expanded supply-chain trust
Risk Level: Medium

Vulnerable Code

yaml

Installation_Command:
  setup: "npx openclaw skills add openclaw-greek-accounting-meta --install-deps"
  verification: "openclaw greek health-check --verify-all-skills"

Technical Analysis

The setup command invokes npx openclaw without an exact package version or integrity constraint. Depending on the local environment and package-manager behavior, npx may retrieve and execute a mutable package from a configured registry.

The --install-deps option further expands the trust boundary by installing companion skills and their dependencies. The project does not provide a lockfile, integrity hashes, a pinned registry source, or documented signature verification for this installation path.

A package takeover, registry compromise, dependency confusion event, malicious update, or compromised transitive dependency could therefore change the code executed by the setup command after this Skill has been reviewed.

Attack Path

1. An administrator follows the documented setup command.
2. npx resolves the unversioned openclaw package from the configured package source or cache.
3. A compromised or malicious package version is selected.
4. Package code or installation lifecycle scripts execute under the administrator's current privileges.
5. --install-deps installs additional mutable components, increasing the number of possible compromise points.
6. Malicious installation code may access credentials, accounting data, OpenClaw configuration, or modify the local environment.

Impact Assessment

Exploitation can result in code execution with the privileges of the user performing installation. If setup is run with elevated privileges, the compromise may extend to system-wide files and services. Under a norm ...[truncated 314 chars]

Remediation

View remediation

Remediation Suggestions

• Pin openclaw and every companion skill to reviewed, exact versions.
• Commit and enforce an appropriate lockfile with integrity metadata.
• Specify and authenticate the expected package registry; reject unexpected mirrors or alternate sources.
• Verify package signatures or published checksums before execution.
• Avoid executing packages directly through an unpinned npx command.
• Review and pin the complete transitive dependency graph installed by --install-deps.
• Disable package lifecycle scripts where operationally possible, or inspect them before installation.
• Perform installation in a restricted environment using a non-privileged account, limited network access, and no production credentials.
• Generate and retain a software bill of materials so installed components can be audited and monitored for compromise.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash

export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq

# Install companion skills (this orchestrator needs them to be useful)
# See the full skill list at: https://github.com/satoshistackalotto/openclaw-greek-accounting

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The expectation requires results to be presented in a 'prioritized English-language summary,' which imposes a specific language choice without indicating user preference or opt-in. This is a natural-language policy issue because it hard-codes locale behavior rather than offering a language choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The prompt 'Process all incoming documents that arrived today' is a broad natural-language trigger that can cause the orchestrator to sweep and act on heterogeneous inputs without clear scoping, client selection, or approval boundaries. In an accounting meta-skill with authority to route emails, OCR documents, bank statements, and move files across /data/incoming/ into client directories, this increases the risk of misclassification, unintended processing of malicious attachments, cross-client data handling mistakes, or bulk actions initiated from an overly generic request.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The documentation instructs users to run sudo apt install jq, which normalizes privilege escalation during setup. Although installing jq is common, embedding root-level commands in a skill increases the chance that operators execute setup steps with elevated privileges in environments that also process sensitive accounting data, expanding the blast radius if surrounding commands or dependencies are compromised.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash

export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq

# Install companion skills (this orchestrator needs them to be useful)
# See the full skill list at: https://github.com/satoshistackalotto/openclaw-greek-accounting

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The managed skill registry explicitly describes an "English UI" and "English queries" for core user-facing components. This is a natural-language locale constraint presented as a requirement, and the document does not offer users a language selection or opt-in despite the skill otherwise serving Greek accounting workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command invokes npx openclaw without pinning an exact package version, which makes the skill depend on whatever version is current at execution time. In a high-privilege accounting orchestrator that installs dependencies and coordinates government/compliance workflows, this creates supply-chain risk: a compromised or breaking upstream release could change behavior or execute unreviewed code during install/use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup workflow sets --language en --data-language el, which enforces English for the dashboard interface. Because this is a user-facing locale decision embedded in the documented workflow and no opt-in or alternative is offered, it violates the language-choice policy.

Content

No source excerpt is available for this finding.