MoneyClaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:22 AM UTC
• Version: 5.5.3

Overview

The skill is mostly disclosed, but it gives agents financial payment authority and includes merchant collection instructions that go beyond the stated buyer-side purpose.

Review this carefully before installing. It is not just a read-only wallet helper: with an API key it can create payment tasks, retrieve payment execution details after approval, reconcile charges, and the package also documents merchant-side invoice and webhook setup. Only install it for an account where you understand MoneyClaw auto-approval settings, prepaid balance limits, hidden-card bootstrap reserves, and whether you want merchant acquiring functions available to the agent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This reference materially expands the skill from buyer-side wallet/payment actions into merchant-side payment collection, invoice hosting, public checkout, widget embedding, and webhook handling. That scope drift can cause an agent to perform actions outside the skill's declared authorization boundary, enabling misuse for third-party merchant operations or broader payment processing workflows the user did not explicitly request.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation explicitly instructs switching to an acquiring mode for merchant-side collection even though the skill metadata limits use to the user's own buyer-side MoneyClaw payments. This creates conflicting guidance that can override higher-level safety boundaries in practice, increasing the chance the agent assists with payment collection, hosted checkout, or webhook setup beyond the intended scope.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

Default to dashboard approval unless the account has explicitly enabled agent auto-approval.

- MoneyClaw accounts expose an account-level `agentAutoApproveEnabled` flag through `GET /api/me`.
- When that flag is off, API-key-created payment tasks wait for dashboard approval before spending.
- When that flag is on, API-key-created payment tasks can be auto-approved within the merchant and amount scope of the task.
- Do not assume agent auto-approval is enabled unless the account state confirms it.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

Default to dashboard approval unless the account has explicitly enabled agent auto-approval.

- MoneyClaw accounts expose an account-level `agentAutoApproveEnabled` flag through `GET /api/me`.
- When that flag is off, API-key-created payment tasks wait for dashboard approval before spending.
- When that flag is on, API-key-created payment tasks can be auto-approved within the merchant and amount scope of the task.
- Do not assume agent auto-approval is enabled unless the account state confirms it.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

Default to dashboard approval unless the account has explicitly enabled agent auto-approval.

- MoneyClaw accounts expose an account-level `agentAutoApproveEnabled` flag through `GET /api/me`.
- When that flag is off, API-key-created payment tasks wait for dashboard approval before spending.
- When that flag is on, API-key-created payment tasks can be auto-approved within the merchant and amount scope of the task.
- Do not assume agent auto-approval is enabled unless the account state confirms it.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

This workflow allows API-key-created tasks to progress directly toward approved payment execution when account auto-approval is enabled, and notes that an initial hidden-card bootstrap may reserve more funds than the immediate purchase amount. That creates a meaningful risk of autonomous spending or over-reservation beyond the user's immediate expectation, especially if the agent interprets prior approval too broadly.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

1. `GET /api/me` for wallet readiness, deposit address, and inbox context. Fresh accounts may also finish mailbox, deposit-address, and provider setup on this first authenticated read.
2. `POST /api/payment-intents` for the exact purchase.
3. If `agentAutoApproveEnabled` is off, wait for dashboard approval. If it is on, the API-key task can move directly toward `approved` and `card_ready`. Approved tasks can auto-prepare or reuse the account's hidden execution card when wallet funding is available.
   On the first hidden-card bootstrap for an account, MoneyClaw may reserve the provider minimum initial deposit onto that shared hidden card even if the current task amount is smaller. Any residual stays on the same hidden card for later tasks.
4. Use `GET /api/payment-intents/:intentId/credentials` only when the task is `card_ready` and the user explicitly asked to continue the current payment step.
5. After a successful one-time checkout, use `POST /api/payment-intents/:intentId/reconcile` to write the settled charge back into MoneyClaw accounting.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

1. Check account readiness

bash

curl -H "Authorization: Bearer $MONEYCLAW_API_KEY" \
  https://moneyclaw.ai/api/me

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

Run this checklist before entering card details:

1. Verify the exact domain. In `paypal.com.secure-verify.net`, the real domain is `secure-verify.net`.
2. Confirm the user explicitly asked to continue this exact payment step, unless the account is clearly configured to auto-approve agent-created payment tasks for this scope.
3. Confirm HTTPS is present, but do not treat HTTPS alone as proof of legitimacy.
4. Confirm the total amount and currency.
5. Confirm wallet or prepared execution balance covers the amount plus a small buffer.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

Run this checklist before entering card details:

1. Verify the exact domain. In `paypal.com.secure-verify.net`, the real domain is `secure-verify.net`.
2. Confirm the user explicitly asked to continue this exact payment step, unless the account is clearly configured to auto-approve agent-created payment tasks for this scope.
3. Confirm HTTPS is present, but do not treat HTTPS alone as proof of legitimacy.
4. Confirm the total amount and currency.
5. Confirm wallet or prepared execution balance covers the amount plus a small buffer.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/payment-safety.md (reported line 33)May include surrounding context.

md

Run this checklist before entering card details:

1. Verify the exact domain. In `paypal.com.secure-verify.net`, the real domain is `secure-verify.net`.
2. Confirm the user explicitly asked to continue this exact payment step, unless the account is clearly configured to auto-approve agent-created payment tasks for this scope.
3. Confirm HTTPS is present, but do not treat HTTPS alone as proof of legitimacy.
4. Confirm the total amount and currency.
5. Confirm wallet or prepared execution balance covers the amount plus a small buffer.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/payment-safety.md (reported line 65)May include surrounding context.

md

Run this checklist before entering card details:

1. Verify the exact domain. In `paypal.com.secure-verify.net`, the real domain is `secure-verify.net`.
2. Confirm the user explicitly asked to continue this exact payment step, unless the account is clearly configured to auto-approve agent-created payment tasks for this scope.
3. Confirm HTTPS is present, but do not treat HTTPS alone as proof of legitimacy.
4. Confirm the total amount and currency.
5. Confirm wallet or prepared execution balance covers the amount plus a small buffer.

Static analysis

No suspicious patterns detected.