ClawHub
Back to skill

Security audit

ClawVault Payments

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly a payments integration, but it can let an agent initiate real crypto transfers and card purchases that auto-approve under rules.

Install only if you intend to let an agent interact with real payment rails. Before use, configure tight spending limits, recipient or merchant allowlists, and manual approval where possible; treat CLAWVAULT_API_KEY as a financial credential and avoid broad auto-approval rules.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

The skill explicitly permits transactions to be executed automatically when they fall within preconfigured rules, meaning an agent can spend funds without per-transaction user confirmation. In a payments context, autonomous execution is materially dangerous because prompt injection, task confusion, or compromised agent logic could trigger real monetary transfers that still satisfy the rules engine.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
1. **Crypto payments** - USDC transfers on Base and Solana blockchains
2. **Agent Card** - Virtual Visa card for any merchant worldwide (SaaS, APIs, cloud, etc.)

Both channels use the same rules engine. Every transaction is validated against user-defined rules. Transactions within rules auto-approve; transactions outside rules require human approval via Telegram or dashboard.

## Security Model

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

Documenting an auto_approved state confirms that payment execution may occur immediately without a fresh human review. For a skill that moves crypto and provisions card purchases, this increases the blast radius of any mistaken or malicious instruction because funds can leave before a user has a chance to intervene.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

text

### Possible Statuses
- `auto_approved` - Payment executed immediately (within rules)
- `pending` - Awaiting human approval via Telegram/dashboard
- `denied` - Payment was rejected
- `expired` - Approval window closed (5 minutes)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The dry-run design is safer than blind execution, but it still normalizes a workflow where the agent decides whether to proceed based on an auto-approve outcome. In a payments skill, that means the agent can convert a policy check directly into a real spend path, which is risky if upstream intent validation is weak.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

2. Check Before Sending (Dry Run)

Before making a payment, check if it will auto-approve or need manual approval:

http
POST /v1/rules/check

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The autoApprove field exposes a machine-readable signal that can be used by the agent to automatically proceed with a real transaction. In this skill's context, that creates a direct automation hook for spending decisions, which is unsafe when combined with LLM susceptibility to manipulation or misunderstanding.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
"success": true,
  "data": {
    "allowed": true,
    "autoApprove": false,
    "reason": "Manual mode",
    "remainingBudget": { "daily": 450.00 },
    "remainingTx": { "daily": 46 }

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

}

text

If `autoApprove: false`, tell the user the payment needs their approval.

---

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Referring to an 'auto-approve threshold' indicates that card purchases below some threshold may be approved and card credentials issued without fresh human review. Because the skill can generate usable payment credentials, any autonomous approval path is sensitive and could enable unauthorized purchases within those limits.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

"data": { "id": "card_txn_abc123", "status": "pending_approval", "reason": "Amount exceeds auto-approve threshold" } }

text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

An autoApprove: true result for card spending provides an explicit automated go/no-go signal that an agent can use to complete purchases. In the context of a virtual Visa card, this is especially risky because it can translate directly into spendable card credentials and rapid financial loss if misused.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md
"success": true,
  "data": {
    "allowed": true,
    "autoApprove": true,
    "reason": "Within limits, allowed category"
  }
}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The scenario guidance tells the agent to check whether a transfer will auto-approve and then proceed to create the payment, reinforcing an end-to-end autonomous spending workflow. In a money-moving skill, this makes the overall design more dangerous because it operationalizes immediate execution rather than merely describing a backend capability.

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

md
4. If `status: "pending_approval"`, tell user: "This purchase needs your approval. Check Telegram or ClawVault dashboard."

### Scenario: User asks to send USDC to an address
1. Call `/v1/rules/check` to see if it will auto-approve
2. Call `/v1/payments` with the recipient address
3. If `status: "pending"`, tell user to approve in Telegram

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 367)May include surrounding context.

md
- Dashboard: https://clawvault.cc
- Docs: https://clawvault.cc/docs
- API Status: https://api.clawvault.cc/health
- Source: https://github.com/andrewszk/clawvault-mcp-server

Static analysis

No suspicious patterns detected.