CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/business-account-opening/SKILL.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptskills/business-account-opening/SKILL.md· markdown

47- **Documents stay local.** Uploaded files are parsed by the AI client. Only structured fiel

… (60 chars elided on L47)

48- **No PII stored by the skill.** The skill does not persist any data. The MCP server create

… (24 chars elided on L48)

49- **No credentials in chat.** Never ask for or accept passwords, API keys, or bank account n

… (7 chars elided on L49)

51## Rules

Occurrences

1 occurrence · at L49

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2565084aa178cfd9d97…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/business-account-opening/SKILL.md · 1 file

skills/business-account-opening/SKILL.md2.4 KB · Markdown

name: business-account-opening

description: >

Open a Vivid Business account via the vivid-mcp remote MCP server.

Collects legal entity data from the user (or extracts it from uploaded

documents locally), then calls the build_onboarding_link tool to generate

a pre-filled onboarding URL. No local install or credentials required.

version: 0.1.0

metadata:

openclaw:

emoji: "🏦"

homepage: "https://github.com/vivid-money/vivid-mcp"

requires:

env: []

bins: []

config: []

Business Account Opening

Open a Vivid Business account using the vivid-mcp remote MCP server.

Integration

Server: https://api.prime.vivid.money/mcp (remote, streamable HTTP)
Tool: build_onboarding_link — accepts legal entity data, returns an onboarding URL
Auth: none required — the endpoint is publicly accessible
Install: nothing to install — the MCP server is hosted by Vivid; the client connects via the .mcp.json config in this repository

Trigger

User wants to open a business account or start business onboarding.

Flow

Ask for legal entity type (GmbH, UG, freelancer, etc.) if not provided.
Ask for country if not provided. Default: Germany.
Call MCP to get required fields and accepted document types.
If the user uploads a document, extract the fields locally in the client — the document itself is never sent to the MCP server. Summarize what was extracted; do not echo raw document contents.
Show the user a summary of all collected data and ask for explicit confirmation before proceeding.
Call build_onboarding_link with the confirmed data. The server returns an onboarding URL.
Present the URL to the user.

Data handling

Documents stay local. Uploaded files are parsed by the AI client. Only structured fields (company name, address, etc.) are sent to the MCP server.
No PII stored by the skill. The skill does not persist any data. The MCP server creates an onboarding session;
No credentials in chat. Never ask for or accept passwords, API keys, or bank account numbers.

Rules

Always confirm collected data with the user before calling build_onboarding_link.
Never call the tool autonomously — require explicit user approval.
Treat uploaded documents as sensitive — summarize only, don't echo contents.
On error: ask for missing fields or suggest a different document.

business-account-opening— agent skill

Is business-account-opening safe to install?

Business Account Opening

Integration

Trigger

Flow

Data handling

Rules

Audit the pieces. Scan the whole. Decide.