ClawHub
Back to skill

Security audit

MoneyClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly disclosed, but it gives agents financial payment authority and includes merchant collection instructions that go beyond the stated buyer-side purpose.

Review this carefully before installing. It is not just a read-only wallet helper: with an API key it can create payment tasks, retrieve payment execution details after approval, reconcile charges, and the package also documents merchant-side invoice and webhook setup. Only install it for an account where you understand MoneyClaw auto-approval settings, prepaid balance limits, hidden-card bootstrap reserves, and whether you want merchant acquiring functions available to the agent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This reference materially expands the skill from buyer-side wallet/payment actions into merchant-side payment collection, invoice hosting, public checkout, widget embedding, and webhook handling. That scope drift can cause an agent to perform actions outside the skill's declared authorization boundary, enabling misuse for third-party merchant operations or broader payment processing workflows the user did not explicitly request.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The documentation explicitly instructs switching to an acquiring mode for merchant-side collection even though the skill metadata limits use to the user's own buyer-side MoneyClaw payments. This creates conflicting guidance that can override higher-level safety boundaries in practice, increasing the chance the agent assists with payment collection, hosted checkout, or webhook setup beyond the intended scope.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Default to dashboard approval unless the account has explicitly enabled agent auto-approval.

- MoneyClaw accounts expose an account-level `agentAutoApproveEnabled` flag through `GET /api/me`.
- When that flag is off, API-key-created payment tasks wait for dashboard approval before spending.
- When that flag is on, API-key-created payment tasks can be auto-approved within the merchant and amount scope of the task.
- Do not assume agent auto-approval is enabled unless the account state confirms it.
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Default to dashboard approval unless the account has explicitly enabled agent auto-approval.

- MoneyClaw accounts expose an account-level `agentAutoApproveEnabled` flag through `GET /api/me`.
- When that flag is off, API-key-created payment tasks wait for dashboard approval before spending.
- When that flag is on, API-key-created payment tasks can be auto-approved within the merchant and amount scope of the task.
- Do not assume agent auto-approval is enabled unless the account state confirms it.
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Default to dashboard approval unless the account has explicitly enabled agent auto-approval.

- MoneyClaw accounts expose an account-level `agentAutoApproveEnabled` flag through `GET /api/me`.
- When that flag is off, API-key-created payment tasks wait for dashboard approval before spending.
- When that flag is on, API-key-created payment tasks can be auto-approved within the merchant and amount scope of the task.
- Do not assume agent auto-approval is enabled unless the account state confirms it.
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
1. `GET /api/me` for wallet readiness, deposit address, and inbox context. Fresh accounts may also finish mailbox, deposit-address, and provider setup on this first authenticated read.
2. `POST /api/payment-intents` for the exact purchase.
3. If `agentAutoApproveEnabled` is off, wait for dashboard approval. If it is on, the API-key task can move directly toward `approved` and `card_ready`. Approved tasks can auto-prepare or reuse the account's hidden execution card when wallet funding is available.
   On the first hidden-card bootstrap for an account, MoneyClaw may reserve the provider minimum initial deposit onto that shared hidden card even if the current task amount is smaller. Any residual stays on the same hidden card for later tasks.
4. Use `GET /api/payment-intents/:intentId/credentials` only when the task is `card_ready` and the user explicitly asked to continue the current payment step.
5. After a successful one-time checkout, use `POST /api/payment-intents/:intentId/reconcile` to write the settled charge back into MoneyClaw accounting.
Confidence
85% confidence
Finding
This workflow allows API-key-created tasks to progress directly toward approved payment execution when account auto-approval is enabled, and notes that an initial hidden-card bootstrap may reserve more funds than the immediate purchase amount. That creates a meaningful risk of autonomous spending or over-reservation beyond the user's immediate expectation, especially if the agent interprets prior approval too broadly.

External Transmission

Medium
Category
Data Exfiltration
Content
### 1. Check account readiness

```bash
curl -H "Authorization: Bearer $MONEYCLAW_API_KEY" \
  https://moneyclaw.ai/api/me
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Run this checklist before entering card details:

1. Verify the exact domain. In `paypal.com.secure-verify.net`, the real domain is `secure-verify.net`.
2. Confirm the user explicitly asked to continue this exact payment step, unless the account is clearly configured to auto-approve agent-created payment tasks for this scope.
3. Confirm HTTPS is present, but do not treat HTTPS alone as proof of legitimacy.
4. Confirm the total amount and currency.
5. Confirm wallet or prepared execution balance covers the amount plus a small buffer.
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Run this checklist before entering card details:

1. Verify the exact domain. In `paypal.com.secure-verify.net`, the real domain is `secure-verify.net`.
2. Confirm the user explicitly asked to continue this exact payment step, unless the account is clearly configured to auto-approve agent-created payment tasks for this scope.
3. Confirm HTTPS is present, but do not treat HTTPS alone as proof of legitimacy.
4. Confirm the total amount and currency.
5. Confirm wallet or prepared execution balance covers the amount plus a small buffer.
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Run this checklist before entering card details:

1. Verify the exact domain. In `paypal.com.secure-verify.net`, the real domain is `secure-verify.net`.
2. Confirm the user explicitly asked to continue this exact payment step, unless the account is clearly configured to auto-approve agent-created payment tasks for this scope.
3. Confirm HTTPS is present, but do not treat HTTPS alone as proof of legitimacy.
4. Confirm the total amount and currency.
5. Confirm wallet or prepared execution balance covers the amount plus a small buffer.
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Run this checklist before entering card details:

1. Verify the exact domain. In `paypal.com.secure-verify.net`, the real domain is `secure-verify.net`.
2. Confirm the user explicitly asked to continue this exact payment step, unless the account is clearly configured to auto-approve agent-created payment tasks for this scope.
3. Confirm HTTPS is present, but do not treat HTTPS alone as proof of legitimacy.
4. Confirm the total amount and currency.
5. Confirm wallet or prepared execution balance covers the amount plus a small buffer.
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.