Security audit

Fiches Clients

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for managing accounting client records, but it gives agents broad authority to change, merge, archive, or remove persistent client data without enough confirmation boundaries.

Install only if you are comfortable giving this skill authority over OpenClaw client records and client folders. Before use, tighten the instructions to require explicit target confirmation for rename, merge, archive, reject-draft, and any delete-like request, and clarify whether index-global.json and per-client index rewrites are owned by this skill or delegated to organisation-documents.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill declares ownership only over `clients.json` and per-client files, but its procedures also rewrite `index-global.json` and linked path fields outside that boundary. This mismatch weakens change-control and isolation guarantees: another skill may assume those files are outside this skill's authority, leading to unauthorized cross-scope mutation, corruption, or race conditions during rename/merge flows.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The reference explicitly permits the `clients` skill to update files such as `index-global.json` and other indexes maintained by `organisation-documents`, creating cross-skill write authority outside its declared ownership. This weakens isolation boundaries, increases the chance of accidental corruption or confused-deputy behavior, and can let one skill tamper with another skill’s integrity-critical state.

Scope Creep

High

Confidence: 97% confidence
Finding: Allowing `clients` to modify `index-global.json` despite that file not being declared in its owned paths is a concrete privilege-boundary violation. Because `index-global.json` appears to be a global index used across clients, unauthorized writes can poison global state, break document routing/deduplication, and enable broad integrity issues beyond a single client record.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill instructs the agent to invoke it 'systematically and without asking for permission' even for destructive operations such as rename, merge, archive, suspend, or delete. In an agentic environment, this reduces user-confirmation safeguards and can turn ambiguous or malicious prompts into immediate persistent changes to regulated client records, increasing the risk of accidental data loss, misassociation, or unauthorized record lifecycle actions.

Static analysis

No suspicious patterns detected.