银行流水解析，流水报告生成等

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:34 PM UTC
• Version: 1.0.8

Overview

This skill does what it says by uploading bank statements to a remote report service, but it handles highly sensitive financial files with weak disclosure, scoping, and credential hygiene.

Review before installing. Use this only if you are comfortable sending complete bank statement files and related questions to the external service named in the scripts. Do not pass real API tokens on the command line; prefer a protected environment variable or secret manager, and rotate any token that may have been logged. Confirm the exact file path before upload and avoid using this on unrelated private files until the skill adds file-type/path restrictions and a clear privacy, retention, and deletion policy.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_file.py:47

Finding

API Credential Exposed Through Required Command-Line Arguments

Content

View full analysis

``` `SKILL.md:77-83`: ```bash # 1. Upload the file upload_result=$(python3 /models/openclaw/skills/flow/scripts/upload_file.py token local_file_path ) server_path=$(echo $upload_result | jq -r .file_path) # 2. Generate the report python3 /models/openclaw/skills/flow/scripts/generate_report.py token "$server_path" query ``` ### Technical Analysis Both scripts support reading the API token from the `ZY_TOKEN` environment variable, but their command-line interfaces require a positional `token` argument. The documented workflow consequently instructs operators or an agent to place the credential directly in the process argument list. Command-line arguments may be exposed through: - Process-inspection utilities available to other local users or monitoring services. - Shell history and terminal-sessi ...[truncated 1496 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_file.py:8

Finding

Unrestricted Transfer of Sensitive Local Files to an External Service

Content

View full analysis

env var final_token = token or os.environ.get("ZY_TOKEN") if final_token: headers["Authorization"] = f"Bearer {final_token}" try: response = requests.post(url, headers=headers, files=files) ``` `scripts/generate_report.py:8-22`: ```python def generate_report(file_urls, query, token=None): url = "https://ziya.dfwytech.com/dfwy_api/lsxx/genarate/report" headers = { "Accept": "*/*", "Connection": "keep-alive", "Content-Type": "application/x-www-form-urlencoded", } # Priority: argument > env var final_token = token or os.environ.get("ZY_TOKEN") if final_token: headers["Authorization"] = f"Bearer {final_token}" data = {"file_urls": file_urls, "query": query} try: response = requests.post(url, headers=headers, data=data) ``` ### Technical Analysis Uploading bank statements to `ziya.dfwytech.com` is explicitly declared and is necessary for the Skill's remote analysis workflow. The behavior is therefore not hidden exfiltration. Both requests also use HTTPS. However, the uploader only checks whether the supplied path exists. It does not verify that: - The path is a regular file rather th ...[truncated 2682 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill promises question-based analysis and report generation, but the visible logic mainly orchestrates upload/report scripts without transparently implementing those capabilities in the skill itself. This is especially risky in the context of bank statements because users may unknowingly authorize external handling of highly sensitive financial records under misleading expectations about what the skill actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill promises question-based analysis and report generation, but the visible logic mainly orchestrates upload/report scripts without transparently implementing those capabilities in the skill itself. This is especially risky in the context of bank statements because users may unknowingly authorize external handling of highly sensitive financial records under misleading expectations about what the skill actually does.

Content

No source excerpt is available for this finding.

Tainted flow: 'files' from open (line 14, file read) → requests.post (network output)

High

• Category: Data Flow
• Confidence: 97% confidence

Finding

The script reads an arbitrary local file path and uploads the file contents to a hard-coded external server, creating a direct local-file-to-network exfiltration path. In the context of a bank statement analysis skill handling potentially sensitive financial documents, this is dangerous because users may not realize their files are being transmitted to a third-party service and there are no safeguards such as destination validation, consent prompts, file-type restrictions, or data minimization.

Content

Scanner excerpt · scripts/upload_file.py (reported line 27)May include surrounding context.

python

headers["Authorization"] = f"Bearer {final_token}"

    try:
        response = requests.post(url, headers=headers, files=files)
        response.raise_for_status()

        data = response.json()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill uses environment variables and performs remote API-backed actions, but it does not declare any explicit tool scope or permissions. This weakens auditability and policy enforcement, making it harder for users or the platform to understand that the skill can access credentials and transmit data externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language content of the skill, including its description and operating instructions, is presented exclusively in Chinese with no stated language choice or opt-in. This creates a language policy issue because the skill implicitly requires a specific language without offering the user an alternative.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to upload local bank statement files to a server but gives no explicit privacy warning, consent checkpoint, retention policy, or data-transfer disclosure. Because bank statements contain highly sensitive financial information, silent transfer to an external server materially increases the risk of privacy violations, regulatory issues, and unauthorized exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a workflow based on user-provided Excel/PDF file paths, automatically uploading those files and generating an analysis report. In this file, the implementation accepts a 'file_urls' argument and posts that value directly to a remote endpoint, with no local file reading or file upload logic, which is a semantic mismatch with the claimed behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script transmits user-supplied file references and query content to an external service without any explicit disclosure, confirmation, or privacy warning. In the context of bank statement analysis, those inputs may contain highly sensitive financial data or identifiers, so silent transmission increases the risk of unintended data exposure to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code silently uploads a user-supplied file to a remote server without any user-facing warning in the script itself about transmission, destination, or sensitivity implications. Because this skill is specifically for bank statement/report generation, the likely uploaded files contain highly sensitive financial data, making undisclosed transfer materially risky even if the functionality is intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill requires a ZY_TOKEN credential but does not warn about secure storage, logging, shell history exposure, or least-privilege handling. While this alone may not create compromise, poor credential hygiene around a network-enabled skill can lead to token leakage and unauthorized use of the external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The hardcoded message api_key无效 presents an error in Chinese only, imposing a specific language choice on users regardless of locale or preference. The file provides no language selection, opt-in, or documentation justifying a Chinese-only interface.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The inline CLI documentation says 'Generate report from server file' and labels the input as 'Server file path', which indicates the code expects a server-side path rather than a local Excel/PDF file to be uploaded. This actively diverges from the higher-level documented intent in the manifest that says the skill takes user input file paths and automatically uploads the files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script automatically reads an access token from the ZY_TOKEN environment variable if no command-line token is supplied, which can obscure to users or operators that a sensitive credential is being consumed and sent as an Authorization header. This is primarily a transparency and credential-handling weakness rather than direct exfiltration of the token, but it can contribute to accidental misuse, especially in shared or automated environments.

Content

No source excerpt is available for this finding.