openclaw-ledger
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: An inconsistency exists between the registered author and the metadata within the skill files.
- Evidence: The skill is attributed to "CaySon" in
SKILL.mdand_meta.json, while the platform context identifies the author as "xianmingyao". The documentation notes this is an adaptation of "phoenixclaw-ledger," which may explain the discrepancy, but the mismatch remains a potential point of identification confusion. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user messages and payment screenshots to update financial records.
- Ingestion points: The skill processes conversation text and OCR-extracted data from payment app screenshots (
SKILL.md). - Boundary markers: Semantic signals and confidence thresholds are used to differentiate financial transactions from general conversation (
references/expense-detection.md). - Capability inventory: Local file writing to YAML and markdown files (
SKILL.md). The skill does not possess network access or arbitrary command execution capabilities. - Sanitization: Sensitive card data is masked, and transactions with low detection confidence require manual user review (
references/payment-screenshot.md).
Audit Metadata