T09 · Insecure Skill Coding Practices
- Location
SKILL.md:94- Finding
Misleading Privacy Assurance for Sensitive Financial Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:36-39, 94-96; equivalent assurance inREADME.md:39-41
Vulnerability Type: Misleading handling and retention claims for sensitive financial data
Risk Level: MediumVulnerable Snippets
From
SKILL.md:36-39:markdown ### Option A: CSV export (preferred) Bank or card transaction export covering at least 60–90 days. Most banks export from the account activity page under "Download" or "Export." **Ask the user to paste CSV contents directly into chat.**From
SKILL.md:94-96:markdown ### Privacy note (once per session, not repeated on follow-ups) > 🔒 **Privacy note:** This skill does not store, log, or transmit your financial data to any third party. Your transaction data passes only through the AI provider you configured in OpenClaw (e.g., Anthropic, OpenAI) — solely for this analysis, with no retention between sessions. For fully offline processing, configure Ollama as your model provider in OpenClaw settings.Equivalent statement from
README.md:39-41:markdown ## Privacy Your financial data is never stored, logged, or transmitted to any third party by this skill. It passes only through the AI provider you configured in OpenClaw (e.g., Anthropic, OpenAI) — solely for this analysis, with no retention between sessions. For fully offline processing, configure Ollama as your model provider in OpenClaw settings.Technical Analysis
The skill explicitly solicits 60–90 days of bank or payment-card transaction data and directs users to paste it into the chat. When a remotely hosted model provider is configured, that transaction history necessarily passes to an external provider for processing.
The statement that financial data is not “transmit[ted] ... to any third party” is therefore inconsistent with the subsequent disclosure that it passes through providers such as Anthropic or OpenAI. In addition, this documentation-only skill has no technical mechanism to enf ...[truncated 2031 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the absolute privacy claim with an accurate disclosure that submitted data is sent to the configured model provider and is governed by that provider's privacy, logging, and retention policies.
- Do not promise “no retention” unless the complete deployment enforces that property and the claim can be verified.
- Before requesting a CSV, instruct users to remove account numbers, card numbers, names, addresses, balances, transaction IDs, and all columns unrelated to the analysis.
- Request only the minimum required fields: transaction date, normalized merchant description, and amount.
- Encourage users to replace merchant names with aliases when exact identities are unnecessary.
- Prefer local preprocessing that extracts likely recurring transactions before any model submission, reducing the amount of financial history disclosed.
- Present local-model processing as an optional privacy measure, while avoiding unconditional guarantees unless the local deployment and its logging configuration have been validated.
- Update both
SKILL.mdandREADME.mdso their privacy language remains consistent.
A safer notice would be:
markdown Your transaction data is processed by the model provider configured in OpenClaw and is subject to that provider's privacy and retention policies. Before submitting an export, remove account numbers, names, addresses, balances, transaction IDs, and unrelated columns. For local processing, you may configure a local model provider and review its logging settings.