Ai Intelligent Expense Reimbursement

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:55 AM UTC
• Version: 1.0.0

Overview

This skill describes high-impact reimbursement automation, including automatic payouts, but installs and runs unreviewed external code without clear payment safeguards.

Review this carefully before installing. Do not use production reimbursement data or payment credentials unless you have independently reviewed the exact external repository commit and dependency set, pinned them, and configured explicit approval and audit controls for any payout workflow.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:42

Finding

Mutable External Repository and Unverified Dependencies Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-45
Vulnerability Type: Remote payload retrieval and insecure dependency installation
Risk Level: High

bash

git clone https://github.com/openclaw-skills/ai-intelligent-expense-reimbursement
cd ai-intelligent-expense-reimbursement
pip install -r requirements.txt
python app.py

Technical Analysis

The audited package contains only SKILL.md and skill.json; it does not include the application implementation or the referenced requirements.txt. Instead, the installation instructions direct users to clone a mutable external Git repository, install its unaudited dependencies, and execute app.py.

The repository is not pinned to a reviewed commit, tag digest, or cryptographically verified release. Its effective payload can therefore change after this package has been reviewed. In addition, pip install -r requirements.txt performs dependency installation without any visible version lock or integrity-hash verification in the audited artifact. Python package installation may execute package build or installation logic, so code execution can occur during dependency installation as well as when app.py is launched.

The provenance is also unclear because skill.json identifies the author as yang1002378395-cmyk, while the installation URL references the openclaw-skills GitHub organization. The artifact provides no explanation or verification of this relationship.

Attack Path

1. An attacker compromises the referenced GitHub repository, gains control of a dependency, or otherwise causes malicious content to be served through the external installation chain.
2. The attacker modifies app.py, requirements.txt, or a dependency installation payload.
3. A user follows the documented instructions and clones the current, externally controlled repository state.
4. pip install -r requirements.txt installs the modified dependencies and may execute malicious build or installation ...[truncated 1021 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete application implementation and dependency manifest in the audited Skill package rather than downloading the effective implementation at installation time.
2. If external retrieval is unavoidable, pin the repository to a specific reviewed commit SHA and verify the downloaded content against an independently published cryptographic digest or signature.
3. Replace unconstrained dependency installation with a fully locked dependency file containing exact versions and integrity hashes, such as a hash-checked requirements file used with pip install --require-hashes.
4. Review direct and transitive dependencies for compromised, abandoned, typosquatted, or dependency-confusion-prone packages.
5. Publish signed, immutable releases and document the trust relationship between the metadata author and the referenced GitHub organization.
6. Run the application in an isolated environment with a dedicated unprivileged account, minimal filesystem and network access, and narrowly scoped financial API credentials.
7. Do not expose production reimbursement records or payment credentials until the exact application source and dependency set have undergone security review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises automatic payout and financial API integration for reimbursement workflows but provides no warning about the possibility of triggering real financial transactions or handling sensitive financial and invoice data. In a payment-related skill, omission of these operational and data-sensitivity warnings can lead users to enable or run it without appropriate safeguards, increasing the risk of unauthorized payouts, data exposure, or misuse in production environments.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The provided skill context describes a purpose of automating expense reimbursement with receipt recognition and approval acceleration, but the manifest description is only a generic placeholder: "AI intelligent ai-intelligent-expense-reimbursement." This fails to accurately describe the skill's intended reimbursement-focused behavior and creates a semantic mismatch between the declared purpose and the manifest's actual description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language content of the skill, including its description and usage sections, is entirely in Chinese. This can amount to a language-policy issue because the skill imposes a specific language without offering an opt-in, alternative language, or stating that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.