Security audit

Bank Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant for banking and crypto operations, but it can move real funds and expose wallet keys with weak safeguards, so users should review it carefully before installing.

Install only in a controlled R&D environment with minimal funds and a least-privileged Wise token. Set a strong CLAWBANK_WALLET_PASSWORD before creating any wallet, avoid using wallets that may have been created with the default password, do not let agents execute transfers or swaps without a separate human confirmation process, and treat any private-key export as full wallet compromise if copied, logged, or shared.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: bankskills/wallet.py:46
Finding: Wallet Keystore Uses a Publicly Known Default Password
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: bankskills/sweeper.py:267
Finding: Token Swaps Disable Minimum-Output Protection
Content: View full analysis
ClawBank amount_in=amount_wei, amount_out_min=0, # TODO: Use Quoter for slippage protection hook_data=b"", # Empty hookData ) .settle(Web3.to_checksum_address(WETH_ADDRESS), 0, False) .take_all(Web3.to_checksum_address(target), 0) .build_v4_swap() ``` The V3 swap has the same condition: ```python swap_input = eth_abi_encode( ["address", "uint256", "uint256", "bytes", "bool"], [ Web3.to_checksum_address(address), # recipient amount_wei, # amountIn 0, # amountOutMin v3_path, # path False # payerIsUser = False (router pays) ] ) ``` ### Technical Analysis Both swap implementations set the minimum acceptable token output to zero. Although the module declares `SLIPPAGE_BPS = 100`, that setting is not applied when transactions are constructed. A minimum-output value is the principal on-chain protection against adverse price movement and manipulated execution. With a value of zero, the router can execute successfully regardless of how few output tokens are received. Local balance checks performed after confirmation only report the loss; they cannot reverse the transaction. The fixed five-minute deadline in the V3 path limits transaction age but does not protect the exchange rate. The V4 path shown does not establish a meaningful nonzero output floor either. ### Attack Path 1. The wallet submits an ETH-to-token transaction with `amountOutMin` set to zero. 2. The pending transaction becomes visible to block builders, validators, searchers, or other mempool observers. 3. An attack ...[truncated 1025 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: bankskills/core/bank/transfer.py:95
Finding: Wise Transfers Are Created and Funded Without a Confirmation Boundary
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (47)

Tainted flow: 'stdin_data' from sys.stdin.read (line 96, user input) → subprocess.run (code execution)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.
Content: Scanner excerpt · bankskills/runtime/runner.py (reported line 58)May include surrounding context.
python
cmd = [str(run_script)] + (args or []) # Execute result = subprocess.run( cmd, input=stdin_data.encode() if stdin_data else None, capture_output=True,

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented functionality includes local wallet creation, keystore storage, RPC balance queries, and private-key export, but the summary description does not foreground these especially sensitive behaviors. In a banking/crypto skill, underemphasizing secret-handling and wallet lifecycle operations can lead to unsafe deployment and misuse of privileged financial capabilities.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Private-key export is an extremely sensitive capability that exceeds what is necessary for routine banking or token swapping. If abused by an agent, prompt injection, or compromised runtime, it enables total theft of on-chain funds and persistent wallet compromise.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The security section says private keys are never logged or exposed, but the documented export-private-key action explicitly returns the private key. This contradiction is dangerous because it can mislead reviewers and users into trusting a skill that has a direct secret-exfiltration capability.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The handler directly exposes a money-transfer action and will execute it whenever the required fields are present, with no explicit confirmation, approval gate, step-up authentication, or dry-run review in this entry point. In a banking skill, that omission is dangerous because any upstream prompt injection, accidental invocation, malformed automation, or unauthorized caller could trigger real fund movement immediately.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function executes the full Wise transfer flow and unconditionally funds the transfer immediately after creation, with no built-in confirmation gate, dry-run mode, or explicit acknowledgment step before the irreversible payment action. In a banking skill, this is especially dangerous because upstream callers, agents, or prompt-influenced workflows can trigger real fund movement from provided parameters, increasing the risk of accidental or socially engineered transfers.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: buy_token signs and submits irreversible on-chain swaps without any explicit user confirmation, preview, or secondary approval, even though it can spend wallet ETH and route through liquidity pools with no slippage protection (amount_out_min=0). In an agent-driven environment, this is especially dangerous because mistaken intent interpretation or adversarial prompting can trigger real financial loss immediately.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: send_token executes ETH and ERC-20 transfers directly after basic format and balance checks, with no user-facing warning, confirmation, or authorization barrier. Because transfers are irreversible and can send the entire wallet balance to an attacker-controlled address, this is a critical risk in the context of a banking skill that has access to real assets and a loaded private key.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module provides a direct private-key export function even though the stated purpose is banking and token swaps, not wallet recovery tooling. Returning raw secret material to callers creates an easy path for account takeover if this function is exposed through an agent tool, logged, intercepted, or invoked by an untrusted prompt.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The function returns the raw private key immediately with no confirmation, secondary approval, or contextual restriction. In an agent setting this is especially dangerous because a single prompt, tool call, or integration bug could disclose the key and irreversibly compromise all assets in the wallet.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code documents that the decrypted private key should never be exposed to tool responses, yet export_private_key does exactly that. This contradiction indicates the intended security boundary is broken, making accidental exposure via agent responses, telemetry, or downstream integrations much more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises capabilities to send money and transfer tokens but does not pair those actions with strong pre-execution confirmation, recipient verification, reversibility warnings, or approval controls. In an agent skill context, documenting high-risk financial actions as routine increases the chance that an LLM-driven agent or user will invoke irreversible transfers based on ambiguous prompts or prompt injection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.