Banking Agent OS

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:45 AM UTC
• Version: 1.0.0

Overview

This banking skill is coherent in purpose but asks users to install unverified external packages and run a financial API with risky defaults and incomplete safety guidance.

Review carefully before installing. Use only an isolated test environment, verify package ownership and source provenance, bind the server to localhost unless you intentionally expose it, add authentication and authorization before any non-demo use, and do not connect real financial accounts or production data based only on this artifact.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:89
• Finding: Unpinned and Unverifiable Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md:89`, `SKILL.md:105`, `SKILL.md:384`, `SKILL.md:417`, `SKILL.md:466`; identical content appears in `SKILL-CLAWHUB.md` at the same lines **Vulnerability Type**: Supply-chain exposure through unpinned and unverifiable dependencies **Risk Level**: High ### Vulnerable Code ```bash # Install the package pip install banking-agent-os ``` ```bash # Install the SDK npm install openclaw-banking-agent-os ``` The package table contradicts the Python installation instruction: ```markdown | **PyPI** | `banking-agent-os` | Coming soon | | **npm** | `openclaw-banking-agent-os` | https://www.npmjs.com/package/openclaw-banking-agent-os | ``` The final installation instruction repeats the unverified package installation: ```markdown **Installation**: `pip install banking-agent-os` or `clawhub install banking-agent-os` ``` ### Technical Analysis The skill directs users to install mutable third-party packages without exact version constraints, integrity hashes, lockfiles, signatures, or vendored source. More importantly, the document recommends `pip install banking-agent-os` while its own platform table states that the PyPI package is “Coming soon.” This creates a dependency-confusion or package-takeover risk. If the expected PyPI name is unregistered, an unrelated party could register it. If it is later published or compromised, an attacker-controlled release could be selected because no version or hash is pinned. Python and npm package installation can execute package lifecycle logic, while importing the installed application executes package code with the user's privileges. The supplied artifact contains no implementation, package manifest, lockfile, release signature, or source code for these dependencies. Consequently, the behavior of the packages and the advertised banking controls cannot be verified from the audited project. ### Attack Path 1. A user follows ...[truncated 1351 chars]
• Remediation: ## Remediation Suggestions 1. Do not recommend the Python package until it is published by a verified owner and its source can be reviewed. 2. Pin every dependency to an exact reviewed version rather than allowing the package manager to select the latest release. 3. For Python installations, provide a requirements or lock file with cryptographic hashes and require hash verification. 4. For npm installations, commit a reviewed lockfile and use reproducible installation commands such as `npm ci`. 5. Publish release provenance, checksums, signatures, and links connecting each registry artifact to a specific source commit. 6. Include the actual application source and package manifests in the skill artifact so security-sensitive behavior can be audited. 7. Perform package installation in an isolated virtual environment or container under a non-privileged account. 8. Verify registry ownership and reserve all documented package names before distributing installation instructions. 9. Apply the same corrections to `SKILL-CLAWHUB.md`, which is an identical duplicate of the affected instructions.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:98
• Finding: Financial API Is Configured to Listen on All Interfaces Without Documented Access Controls## Vulnerability Details **File Location**: `SKILL.md:98`, `SKILL.md:134`, `SKILL.md:148`, `SKILL.md:166-193`, `SKILL.md:433-436`; identical content appears in `SKILL-CLAWHUB.md` at the same lines **Vulnerability Type**: Unsafe network exposure and missing documented authentication and rate limiting **Risk Level**: High ### Vulnerable Code The installation and quick-start sections repeatedly bind the service to every available network interface: ```bash # Start the server python -m uvicorn app.main:app --host 0.0.0.0 --port 8000 ``` The documented API includes operations involving accounts and transactions: ```markdown ### Accounts (3 endpoints) - `POST /api/accounts` - Create new account - `GET /api/accounts/{account_id}` - Get account details - `GET /api/accounts/user/{user_id}` - Get user's accounts ### Transactions (3 endpoints) - `POST /api/transactions` - Create transaction - `GET /api/transactions/{transaction_id}` - Get transaction details - `GET /api/transactions/account/{account_id}` - Get account transactions ### AI Service (4 endpoints) - `POST /api/ai/chat` - AI customer support - `POST /api/ai/analyze-transaction` - Analyze transaction - `POST /api/ai/financial-advice` - Get financial advice - `POST /api/ai/detect-anomalies` - Detect anomalies ``` The documented requests do not include authentication credentials: ```bash curl -X POST http://localhost:8000/api/transactions \ -H 'Content-Type: application/json' \ -d '{ "from_account_id": "acc_xxx", "to_account_id": "acc_yyy", "amount": 100.00, "transaction_type": "transfer", "description": "Payment" }' ``` Rate limiting is listed only as a future feature: ```markdown ### v1.1.0 (Planned) - Rate limiting and throttling - Webhook notifications - Enhanced fraud detection models - Multi-language support for AI ``` ### Technical Analysis Binding Uvicorn to `0.0.0.0` makes th ...[truncated 2620 chars]
• Remediation: ## Remediation Suggestions 1. Change the default development command to bind only to the loopback interface: ```bash python -m uvicorn app.main:app --host 127.0.0.1 --port 8000 ``` 2. Require explicit administrator opt-in before binding to non-loopback interfaces. 3. Enforce authentication on every non-health endpoint using short-lived, securely validated credentials. 4. Implement object-level authorization so users and agents can access only their own accounts, transactions, and reports. 5. Require additional authorization or approval for balance changes, withdrawals, transfers, account freezing, and other high-impact operations. 6. Place production deployments behind a TLS-enabled reverse proxy or gateway; do not transmit financial or authentication data over plaintext HTTP. 7. Implement rate limits and quotas before production use, particularly for transaction and OpenAI-backed endpoints. 8. Restrict inbound access using host firewalls, cloud security groups, private networks, or mutually authenticated service meshes. 9. Add audit logging, replay protection, transaction idempotency controls, anomaly monitoring, and alerting. 10. Update every request example to show the required authorization mechanism and clearly separate local development from production deployment. 11. Remove the “Production Ready” designation until the implementation and access controls are included and independently reviewed. 12. Apply the same corrections to `SKILL-CLAWHUB.md`, which contains the same unsafe deployment instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/banking-agent-os

# Configure environment
cp .env.example .env
# Edit .env to add your OPENAI_API_KEY

# Start server

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

pip install banking-agent-os

# Create configuration file
cat > .env << EOF
OPENAI_API_KEY=your_openai_api_key_here
DATABASE_URL=sqlite+aiosqlite:///./banking_agent.db
EOF

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

pip install banking-agent-os

# Create configuration file
cat > .env << EOF
OPENAI_API_KEY=your_openai_api_key_here
DATABASE_URL=sqlite+aiosqlite:///./banking_agent.db
EOF

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

pip install banking-agent-os

# Create configuration file
cat > .env << EOF
OPENAI_API_KEY=your_openai_api_key_here
DATABASE_URL=sqlite+aiosqlite:///./banking_agent.db
EOF

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

pip install banking-agent-os

# Create configuration file
cat > .env << EOF
OPENAI_API_KEY=your_openai_api_key_here
DATABASE_URL=sqlite+aiosqlite:///./banking_agent.db
EOF

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

pip install banking-agent-os

# Create configuration file
cat > .env << EOF
OPENAI_API_KEY=your_openai_api_key_here
DATABASE_URL=sqlite+aiosqlite:///./banking_agent.db
EOF

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation provides live account creation and fund transfer examples, including setting initial balances, without clearly warning users to use a sandbox or test environment. In a banking-related skill, this can lead operators or agents to perform real financial-state changes against production-like systems by copy-pasting examples, causing unintended account creation or movement of funds.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Check if server is running
curl http://localhost:8000/health

# If not running, start it:
python -m uvicorn app.main:app --host 0.0.0.0 --port 8000

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Check if server is running
curl http://localhost:8000/health

# If not running, start it:
python -m uvicorn app.main:app --host 0.0.0.0 --port 8000

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill provides concrete examples for creating accounts and transferring funds but does not include an explicit warning that these actions can affect real money and must only be performed against authorized or test environments. In a banking context, omission of such guardrails increases the chance that a user or agent executes live financial operations unintentionally.

Static analysis

No suspicious patterns detected.