ClawHub
Back to skill

Security audit

Wafeq API Reference

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Wafeq accounting API skill; it is coherent, but it can guide high-impact financial, tax-reporting, and email-sending actions.

Install only if you intend to let an agent help with Wafeq accounting API work. Use a least-privilege API key, prefer a sandbox or test organization first, and require explicit review of recipients, amounts, record IDs, and tax-reporting actions before any write, delete, payment, payroll, bulk email, or tax-authority request is made.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (67)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/accounts-banking-contacts.md (reported line 138)May include surrounding context.

Delete Account

text
DELETE /accounts/{id}/

Path Parameters: id (string, required)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/accounts-banking-contacts.md (reported line 252)May include surrounding context.

Delete Bank Account

text
DELETE /bank-accounts/{id}/

Path Parameters: id (string, required)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/accounts-banking-contacts.md (reported line 366)May include surrounding context.

Delete Bank Ledger Transaction

text
DELETE /bank-accounts/{bank_account_id}/ledger-transactions/{id}/

Path Parameters: bank_account_id (string, required), id (string, required)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/accounts-banking-contacts.md (reported line 483)May include surrounding context.

Delete Bank Statement Transaction

text
DELETE /bank-accounts/{bank_account_id}/statement-transactions/{id}/

Path Parameters: bank_account_id (string, required), id (string, required)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/accounts-banking-contacts.md (reported line 612)May include surrounding context.

Delete Contact

text
DELETE /contacts/{id}/

Path Parameters: id (string, required)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/accounts-banking-contacts.md (reported line 734)May include surrounding context.

Delete Beneficiary

text
DELETE /beneficiaries/{id}/

Path Parameters: id (string, required)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

This documentation exposes both destructive deletion and an externally visible tax-authority reporting action without any warning about irreversible effects or regulatory consequences. In an agent skill context, documenting such side-effecting operations without strong caution increases the risk that an agent may perform compliance-impacting actions or submit data externally without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The bulk send endpoint directly emails recipients and transmits contact and financial document data to external parties, yet the documentation does not prominently warn about external disclosure or accidental delivery. In an agent setting, this materially increases the risk of unauthorized outbound communication, privacy breaches, and disclosure of accounting documents to unintended recipients.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/bills-expenses-notes.md (reported line 745)May include surrounding context.

md
| Resource | Create | List | Retrieve | Update | Partial Update | Delete | Download | Other |
|----------|--------|------|----------|--------|----------------|--------|----------|-------|
| Bills | POST /bills/ | GET /bills/ | GET /bills/{id}/ | PUT /bills/{id}/ | PATCH /bills/{id}/ | DELETE /bills/{id}/ | GET /bills/{id}/download/ | - |
| Bill Line Items | POST /bills/{bill_id}/line-items/ | GET /bills/{bill_id}/line-items/ | GET /bills/{bill_id}/line-items/{id}/ | PUT .../{id}/ | PATCH .../{id}/ | DELETE .../{id}/ | - | - |
| Expenses | POST /expenses/ | GET /expenses/ | GET /expenses/{id}/ | PUT /expenses/{id}/ | PATCH /expenses/{id}/ | DELETE /expenses/{id}/ | - | - |
| Credit Notes | POST /credit-notes/ | GET /credit-notes/ | GET /credit-notes/{id}/ | PUT /credit-notes/{id}/ | PATCH /credit-notes/{id}/ | DELETE /credit-notes/{id}/ | GET .../download/ | POST .../tax-authority/report/ |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/bills-expenses-notes.md (reported line 747)May include surrounding context.

md
|----------|--------|------|----------|--------|----------------|--------|----------|-------|
| Bills | POST /bills/ | GET /bills/ | GET /bills/{id}/ | PUT /bills/{id}/ | PATCH /bills/{id}/ | DELETE /bills/{id}/ | GET /bills/{id}/download/ | - |
| Bill Line Items | POST /bills/{bill_id}/line-items/ | GET /bills/{bill_id}/line-items/ | GET /bills/{bill_id}/line-items/{id}/ | PUT .../{id}/ | PATCH .../{id}/ | DELETE .../{id}/ | - | - |
| Expenses | POST /expenses/ | GET /expenses/ | GET /expenses/{id}/ | PUT /expenses/{id}/ | PATCH /expenses/{id}/ | DELETE /expenses/{id}/ | - | - |
| Credit Notes | POST /credit-notes/ | GET /credit-notes/ | GET /credit-notes/{id}/ | PUT /credit-notes/{id}/ | PATCH /credit-notes/{id}/ | DELETE /credit-notes/{id}/ | GET .../download/ | POST .../tax-authority/report/ |
| CN Line Items | POST /credit-notes/{cn_id}/line-items/ | GET .../ | GET .../{id}/ | PUT .../{id}/ | PATCH .../{id}/ | DELETE .../{id}/ | - | - |
| CN Bulk | POST /api-credit-notes/bulk_send/ | GET /api-credit-notes/ | GET /api-credit-notes/{id}/ | - | - | DELETE /api-credit-notes/{id}/ | GET .../download/ | - |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/bills-expenses-notes.md (reported line 748)May include surrounding context.

md
| Bills | POST /bills/ | GET /bills/ | GET /bills/{id}/ | PUT /bills/{id}/ | PATCH /bills/{id}/ | DELETE /bills/{id}/ | GET /bills/{id}/download/ | - |
| Bill Line Items | POST /bills/{bill_id}/line-items/ | GET /bills/{bill_id}/line-items/ | GET /bills/{bill_id}/line-items/{id}/ | PUT .../{id}/ | PATCH .../{id}/ | DELETE .../{id}/ | - | - |
| Expenses | POST /expenses/ | GET /expenses/ | GET /expenses/{id}/ | PUT /expenses/{id}/ | PATCH /expenses/{id}/ | DELETE /expenses/{id}/ | - | - |
| Credit Notes | POST /credit-notes/ | GET /credit-notes/ | GET /credit-notes/{id}/ | PUT /credit-notes/{id}/ | PATCH /credit-notes/{id}/ | DELETE /credit-notes/{id}/ | GET .../download/ | POST .../tax-authority/report/ |
| CN Line Items | POST /credit-notes/{cn_id}/line-items/ | GET .../ | GET .../{id}/ | PUT .../{id}/ | PATCH .../{id}/ | DELETE .../{id}/ | - | - |
| CN Bulk | POST /api-credit-notes/bulk_send/ | GET /api-credit-notes/ | GET /api-credit-notes/{id}/ | - | - | DELETE /api-credit-notes/{id}/ | GET .../download/ | - |
| Debit Notes | POST /debit-notes/ | GET /debit-notes/ | GET /debit-notes/{id}/ | PUT /debit-notes/{id}/ | PATCH /debit-notes/{id}/ | DELETE /debit-notes/{id}/ | GET .../download/ | - |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/bills-expenses-notes.md (reported line 750)May include surrounding context.

md
| Expenses | POST /expenses/ | GET /expenses/ | GET /expenses/{id}/ | PUT /expenses/{id}/ | PATCH /expenses/{id}/ | DELETE /expenses/{id}/ | - | - |
| Credit Notes | POST /credit-notes/ | GET /credit-notes/ | GET /credit-notes/{id}/ | PUT /credit-notes/{id}/ | PATCH /credit-notes/{id}/ | DELETE /credit-notes/{id}/ | GET .../download/ | POST .../tax-authority/report/ |
| CN Line Items | POST /credit-notes/{cn_id}/line-items/ | GET .../ | GET .../{id}/ | PUT .../{id}/ | PATCH .../{id}/ | DELETE .../{id}/ | - | - |
| CN Bulk | POST /api-credit-notes/bulk_send/ | GET /api-credit-notes/ | GET /api-credit-notes/{id}/ | - | - | DELETE /api-credit-notes/{id}/ | GET .../download/ | - |
| Debit Notes | POST /debit-notes/ | GET /debit-notes/ | GET /debit-notes/{id}/ | PUT /debit-notes/{id}/ | PATCH /debit-notes/{id}/ | DELETE /debit-notes/{id}/ | GET .../download/ | - |
| DN Line Items | POST /debit-notes/{dn_id}/line-items/ | GET .../ | GET .../{id}/ | PUT .../{id}/ | PATCH .../{id}/ | DELETE .../{id}/ | - | - |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/bills-expenses-notes.md (reported line 751)May include surrounding context.

md
| Credit Notes | POST /credit-notes/ | GET /credit-notes/ | GET /credit-notes/{id}/ | PUT /credit-notes/{id}/ | PATCH /credit-notes/{id}/ | DELETE /credit-notes/{id}/ | GET .../download/ | POST .../tax-authority/report/ |
| CN Line Items | POST /credit-notes/{cn_id}/line-items/ | GET .../ | GET .../{id}/ | PUT .../{id}/ | PATCH .../{id}/ | DELETE .../{id}/ | - | - |
| CN Bulk | POST /api-credit-notes/bulk_send/ | GET /api-credit-notes/ | GET /api-credit-notes/{id}/ | - | - | DELETE /api-credit-notes/{id}/ | GET .../download/ | - |
| Debit Notes | POST /debit-notes/ | GET /debit-notes/ | GET /debit-notes/{id}/ | PUT /debit-notes/{id}/ | PATCH /debit-notes/{id}/ | DELETE /debit-notes/{id}/ | GET .../download/ | - |
| DN Line Items | POST /debit-notes/{dn_id}/line-items/ | GET .../ | GET .../{id}/ | PUT .../{id}/ | PATCH .../{id}/ | DELETE .../{id}/ | - | - |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/core-concepts.md (reported line 71)May include surrounding context.

md
| Token | Validity |
|-------|----------|
| Access token | 30 days |
| Refresh token | 6 months |
| Authorization code | 1 hour |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/core-concepts.md (reported line 321)May include surrounding context.

md
### Relevant API Endpoints

1. **Authorization** - OAuth connect and store access tokens
2. **Accounts List** - `GET /v1/accounts/` filtered on `EXPENSE` classification
3. **Expenses Create** - `POST /v1/expenses/` for individual approved expenses
4. **Bank Statement Transactions** - Create statement transactions for reconciliation

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/quotes-payments-remaining.md (reported line 80)May include surrounding context.

md
- **Request:** PatchedEstimate (all fields optional)
- **Response:** 200 -- Updated Estimate

#### DELETE /quotes/{id}/ -- Delete Quote
- **Path:** id (string, required)
- **Response:** 204 No Content

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/quotes-payments-remaining.md (reported line 119)May include surrounding context.

md
- **Request:** PatchedEstimateLineItem (all optional)
- **Response:** 200

#### DELETE /quotes/{quote_id}/line-items/{id}/ -- Delete Line Item
- **Path:** quote_id, id (both required)
- **Response:** 204 No Content

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/quotes-payments-remaining.md (reported line 183)May include surrounding context.

md
- **Request:** PatchedPayment (all optional)
- **Response:** 200

#### DELETE /payments/{id}/ -- Delete Payment
- **Response:** 204 No Content

#### GET /payments/{id}/download/ -- Download Payment PDF

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/quotes-payments-remaining.md (reported line 237)May include surrounding context.

md
#### PATCH /payment_requests/{id}/ -- Partial Update Payment Request
- **Response:** 200

#### DELETE /payment_requests/{id}/ -- Delete Payment Request
- **Response:** 204 No Content

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/quotes-payments-remaining.md (reported line 292)May include surrounding context.

md
#### PATCH /payslips/{id}/ -- Partial Update Payslip
- **Response:** 200

#### DELETE /payslips/{id}/ -- Delete Payslip
- **Response:** 204 No Content

#### GET /payslips/{id}/download/ -- Download Payslip PDF

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/quotes-payments-remaining.md (reported line 319)May include surrounding context.

md
- **Request:** PatchedPayItem (all optional)
- **Response:** 200

#### DELETE /payslips/{payslip_id}/pay-items/{id}/ -- Delete Pay Item
- **Response:** 204 No Content

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/quotes-payments-remaining.md (reported line 368)May include surrounding context.

md
- **Request:** PatchedItem (all optional)
- **Response:** 200

#### DELETE /items/{id}/ -- Delete Item
- **Response:** 204 No Content

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/quotes-payments-remaining.md (reported line 407)May include surrounding context.

md
#### GET /files/{id}/ -- Retrieve File
- **Response:** 200 -- File object

#### DELETE /files/{id}/ -- Delete File
- **Response:** 204 No Content

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/quotes-payments-remaining.md (reported line 471)May include surrounding context.

md
- **Request:** PatchedManualJournal (all optional)
- **Response:** 200

#### DELETE /manual-journals/{id}/ -- Delete Manual Journal
- **Response:** 204 No Content

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/quotes-payments-remaining.md (reported line 627)May include surrounding context.

md
#### PATCH /branches/{id}/ -- Partial Update Branch
- **Response:** 200

#### DELETE /branches/{id}/ -- Delete Branch
- **Response:** 204 No Content

---