T09 · Insecure Skill Coding Practices
Error
- Location
openclaw-plugin/src/index.ts:68- Finding
High-Impact Financial Operations Lack Enforceable Authorization and Confirmation
- Content
View full analysis
) { writeLog(`TOOL_CALL ${tool.name} params=${JSON.stringify(params)}`); try { const result = await tool.execute(params); writeLog(`TOOL_RESULT ${tool.name} result=${JSON.stringify(result)}`); return result; } catch (err: any) { writeLog(`TOOL_ERROR ${tool.name} error=${err?.stack || err?.message || String(err)}`); throw err; } }, }) ``` `openclaw-plugin/src/tools/wallet.ts:86-107`: ```typescript { name: "zke_create_withdraw", description: "Create a ZKE withdrawal request", inputSchema: { type: "object", properties: { coin: { type: "string", description: "e.g. USDTBSC or asset symbol used by your local CLI" }, address: { type: "string" }, amount: { type: "string" }, memo: { type: "string" }, }, required: ["coin", "address", "amount"], additionalProperties: false, }, execute: async ({ coin, address, amount, memo = "" }) => { const args = ["withdraw", String(coin), String(address), String(amount)]; if (String(memo).trim()) { args.push(String(memo)); } args.push("--json"); return await runMainJson(args, config); }, }, ``` `main.py:494-510`: ```python if cmd == "withdraw": coin = sys.argv[2] address = sys.argv[3] amount = sys.argv[4] memo = sys.argv[5] if len(sys.argv) > 5 and sys.argv[5] != "" else None data = withdraw ...[truncated 3471 chars]- Remediation
View remediation