Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent OpenFinance helper skill that accesses sensitive financial data as its stated purpose, with no hidden execution or persistence found.
Install only if you intend the agent to access OpenFinance-connected account balances and transaction history. Keep OPENFINANCE_API_KEY private, request only needed fields or date ranges, and avoid posting reconnect links or financial responses in shared chats or logs.
The skill instructs users to query bank accounts and transactions through remote API endpoints without any explicit warning that this is highly sensitive financial data. In an AI-agent context, users may not realize the privacy implications of transmitting balances, account metadata, and transaction histories to an external service, increasing the risk of unintended disclosure.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Approved functions: COUNT, SUM, AVG, MIN, MAX, ABS, ROUND, CEIL, CEILING, FLOOR, LOWER, UPPER, LENGTH, TRIM, BTRIM, LTRIM, RTRIM, SUBSTRING, SUBSTR, REPLACE, DATE_TRUNC, DATE_PART, EXTRACT, TO_CHAR. CASE, COALESCE, NULLIF, GREATEST, LEAST, CURRENT_DATE, and CURRENT_TIMESTAMP are also supported. Casts are limited to built-in boolean, integer, numeric, floating-point, text, date, timestamp, and interval types. Arithmetic, comparisons, LIKE/ILIKE, IN, BETWEEN, and NULL/boolean tests are supported; custom operators, regex operators, COLLATE, and unlisted syntax are rejected. Function and type names may be unqualified or qualified with pg_catalog.
curl -s -X POST "$BASE_URL/api/transactions/query" \
-H "$AUTH_HEADER" \
-H "Content-Type: application/json" \
-d '{"sql": "SELECT SUM(amount), COUNT(*) FROM txns WHERE merchant_name ILIKE '\''%starbucks%'\''"}' \
The reconnect-link feature creates a bearer-style public URL that can facilitate bank account reconnection, but the documentation does not emphasize that this link is sensitive and should only be shared with the account owner through a secure channel. If exposed in logs, chats, or to the wrong recipient, an unauthorized party may be able to initiate or interfere with the reconnection flow and gain sensitive institution context.
No suspicious patterns detected.