Unauthorized Tool Use

The skill does not declare 'allowed-tools' in its YAML manifest, meaning it can use any agent tool without restriction. The skill executes Python scripts that perform network operations, file I/O, and email operations. Users cannot verify what tools the skill will use before installation.

SKILL.md

YAML manifest shows: allowed-tools: Not specified. Python scripts perform network requests, file operations, and execute external commands.

Detects system manipulation, privilege escalation, and destructive file operations: find "${BACKUP_DIR}" -name "*.log" -mtime +30 -delete

bin/lib/cron.sh:76

find "${BACKUP_DIR}" -name "*.log" -mtime +30 -delete 2>/dev/null

The skill depends entirely on an external 'bankr' tool located at ~/clawd/skills/bankr/scripts/bankr.sh with no verification of its integrity, authenticity, or behavior. All trading commands are passed directly to this external script, creating a tool poisoning risk where a compromised or malicious bankr tool could execute arbitrary actions.

scripts/check-portfolio.sh

BANKR_SCRIPT="$HOME/clawd/skills/bankr/scripts/bankr.sh"
if [ ! -f "$BANKR_SCRIPT" ]; then

The skill is designed to 'autonomously write new code or update their own memory to improve performance' and 'scans memory and history files.' This represents tool exploitation where the skill manipulates the agent's core functionality, memory systems, and potentially other skills without proper authorization boundaries. The skill can modify its own behavior and that of other system components.

SKILL.md

'allows OpenClaw agents to inspect their own runtime history, identify failures or inefficiencies, and autonomously write new code or update their own memory' 'Auto-Log Analysis: Automatically scans memory and history files' 'Self-Repair: Detects crashes and suggests patches'