Mercury Bank

Mercury bank API for Digital 4 Jesus LLC (US entity). Use when the user asks about Mercury account balances, transactions, invoices, customers, or sending mo...

This skill appears to be a genuine Mercury API helper, but it expects a banking API token stored in ~/.secrets/mercury.env even though the registry doesn't declare that requirement. Before installing: (1) verify the skill's source and trustworthiness; (2) inspect scripts/mercury.sh yourself (it is included) and confirm it only calls Mercury endpoints; (3) do not place high-privilege API tokens in a file until you confirm where and how the agent will access them — prefer a token with minimal permissions or a read-only scope if possible; (4) be cautious because the script can create invoices and send money — if you proceed, restrict the token's capabilities and audit actions/logs on the Mercury side. If you cannot verify the publisher or correct the declared requirements, treat this skill as untrusted.

Type: OpenClaw Skill Name: mercury-bank Version: 1.0.0 The skill contains a critical command injection vulnerability in `scripts/mercury.sh`. Specifically, the `create-invoice` command interpolates shell variables (such as `$MEMO` and `$INV_NUM`) directly into a Python script string executed via `python3 -c`, allowing for arbitrary code execution if malicious input is provided. While this represents a significant security risk (RCE), there is no clear evidence of intentional malice, data exfiltration to third-party domains, or unauthorized persistence, as the script's logic is otherwise aligned with its stated purpose of managing Mercury bank accounts.