ClawHub
Back to skill

Security audit

agentcard.ai

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for prepaid card workflows, but it warrants review because it asks agents to install a mutable global CLI and handle real spending authority plus full card details.

Install only if you are comfortable letting an agent help manage prepaid card purchases. Keep user confirmation enabled, use low card amounts, avoid showing full card details in chat unless necessary, and prefer a pinned or isolated CLI install before using it for real payments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:21
Finding

Unpinned Third-Party CLI Installed Globally and Executed

Content
View full analysis
Remediation
View remediation
``` 6. Audit the complete CLI implementation and its transitive dependencies, especially code handling authentication, network requests, card details, refunds, and support submissions. 7. Execute the CLI under a dedicated low-privilege account with restricted filesystem and network access. Permit communication only with documented service endpoints where operationally feasible. 8. Keep card details transient, prevent them from entering logs or shell history, and never persist card numbers, CVVs, or expiration dates locally. 9. Add a release-update process that requires security review before changing the pinned CLI version. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This skill gives an agent the ability to acquire prepaid Visa cards and fund arbitrary online transactions, which is a powerful financial primitive. In an unknown-purpose or broadly permissioned agent environment, that capability can be abused for unauthorized purchases, laundering spend through third-party services, or bypassing normal payment approval controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs the agent to retrieve and potentially display full payment card details, including for use in downstream purchases. Even though it says to only display them on explicit user request, exposing PAN/CVV/expiry to a general-purpose agent materially increases the chance of credential leakage, misuse, prompt-induced exfiltration, or accidental logging.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
- **Email commands** (signup): the CLI sends a magic link and polls until the user clicks it. Let the user know to check their inbox, then wait for the CLI to finish.
- **Browser commands** (card purchase): the CLI opens a URL in the user's browser. Wait for the CLI to finish — it polls automatically.
- If you lose track of a card ID, run `agentcard list` to retrieve all your card IDs, then use `agentcard details <id>` to get the full details again.
- Run any command with `--help` for detailed usage.

### Reporting Issues

Static analysis

No suspicious patterns detected.