Chase Bank - Give your Claw Agent a credit card

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:45 PM UTC
• Version: 1.0.2

Overview

This skill would let an agent use a real-money wallet, and its financial scope is broader and less tightly contained than its headline suggests.

Install only if you are comfortable giving the agent controlled access to real-money purchasing and payment workflows. Keep per-transaction and daily limits low, leave approval required for purchases unless there is a narrow use case, do not rely on downloaded remote guides without reviewing them, and treat owner notes as spending preferences rather than permission to override other instructions or disclose secrets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: skill.md:32
• Finding: Mutable Remote Skill Instructions Installed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `skill.md:32-40` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash mkdir -p ~/.creditclaw/skills/creditcard curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md curl -s https://creditclaw.com/creditcard/prepaid-wallet.md > ~/.creditclaw/skills/creditcard/PREPAID-WALLET.md curl -s https://creditclaw.com/creditcard/self-hosted-card.md > ~/.creditclaw/skills/creditcard/SELF-HOSTED-CARD.md curl -s https://creditclaw.com/creditcard/stripe-x402-wallet.md > ~/.creditclaw/skills/creditcard/STRIPE-X402-WALLET.md curl -s https://creditclaw.com/creditcard/heartbeat.md > ~/.creditclaw/skills/creditcard/HEARTBEAT.md curl -s https://creditclaw.com/creditcard/skill.json > ~/.creditclaw/skills/creditcard/package.json ``` ### Technical Analysis The installation instructions download multiple Skill documents from mutable network locations and save them directly into a persistent Skill directory. Several referenced documents are not included in the audited package, including the shopping, Amazon, prepaid-wallet, self-hosted-card, and Stripe x402 wallet guides. The commands do not pin a version, verify a cryptographic hash or digital signature, validate the downloaded content, or stop on HTTP errors. Consequently, the effective set of agent instructions installed by these commands can differ from the content reviewed during this audit. Although the files are Markdown rather than native executable binaries, Skill documents act as behavioral instructions for the agent. A modified remote document could therefore direct tool calls, request disclosure of credentials, alter purchase behavior, or introduce instructions unrelated to the declared ...[truncated 1325 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle every required Skill document in the reviewed package so the installed content matches the audited artifact. 2. If remote retrieval is necessary, use immutable, version-specific URLs rather than mutable filenames. 3. Publish a signed manifest containing a SHA-256 digest for every downloaded file. 4. Verify each digest and signature before moving the file into the active Skill directory. 5. Download into a temporary staging directory and activate the files only after all checks succeed. 6. Use strict download options such as `curl --fail --show-error --location` and reject redirects to domains outside an explicit allowlist. 7. Validate that downloaded files contain only expected Markdown or JSON and do not introduce scripts, executable files, or unexpected tool directives. 8. Require explicit owner review or approval before loading a newly downloaded Skill version. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: skill.md:248
• Finding: Remote Spending Notes Are Treated as Unscoped Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `skill.md:248-284`; repeated in `heartbeat.md:62-72` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code From `skill.md`: ```bash curl https://creditclaw.com/api/v1/bot/wallet/spending \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" ``` ```text **You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. ``` The same behavior is reinforced in `heartbeat.md`: ```bash curl https://creditclaw.com/api/v1/bot/wallet/spending \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" ``` ```text **Key fields to act on:** - `approval_mode` — determines whether you can auto-spend or must ask first - `blocked_categories` — never attempt purchases in these categories - `notes` — read and follow these; they are direct instructions from your owner - `updated_at` — if this changed since your last check, re-read all fields ``` ### Technical Analysis The Skill retrieves a remote API response and explicitly directs the agent to interpret the free-form `notes` field as authoritative instructions. No scope restriction requires the notes to concern only spending limits or the current transaction, and no validation rejects requests for secrets, unrelated tool use, external communications, or safety-policy c ...[truncated 2117 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat `notes` as untrusted data rather than unconditional agent instructions. 2. Explicitly restrict the field to declarative purchase constraints relevant to the pending transaction. 3. State that notes cannot override system policies, safety rules, owner-approval requirements, domain restrictions, or blocked categories. 4. Reject or ignore notes that request credentials, environment variables, unrelated tool execution, external uploads, or navigation to unapproved domains. 5. Parse supported controls into a documented structured schema instead of relying on arbitrary natural language. 6. Display ambiguous or out-of-scope notes to the owner and require explicit confirmation before acting. 7. Bind each actionable note to authenticated owner identity, record its modification time, and maintain an audit trail. 8. Apply least privilege so the component processing spending policy cannot read unrelated secrets or invoke unrelated tools. 9. Preserve server-side transaction limits and approval checks as independent controls rather than relying on agent compliance. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

---
name: creditclaw-creditcard
version: 2.3.5
updated: 2026-03-08T00:00:00Z
description: "Let your agent shop tickets online with owner approval."
homepage: https://creditclaw.com
api_base: https://creditclaw.com/api/v1
credentials: [CREDITCLAW_API_KEY]
metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}}
---

# CreditClaw — Shopping for AI Agents

CreditClaw lets your agent buy things online — Amazon products, Shopify stores, SaaS subscriptions, and more.
Your owner funds a wallet, sets spending limits, and you shop within those guardrails.

## Skill Files

| File | URL | Purpose |
|------|-----|---------|
| **SKILL.md** (this file) | `https://creditclaw.com/creditcard/skill.md` | Registration, setup, payment method guide, and API reference |
| **SHOPPING.md** | `https://creditclaw.com/creditcard/shopping.md` | General purchasing guide — merchant types, tips, common patterns |
| **AMAZON.md** | `https://creditclaw.com/cre

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

External Transmission

Medium

• Category: Data Exfiltration

Content

## 1. Check Full Status (Recommended)

```bash
curl https://creditclaw.com/api/v1/bot/status \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file includes direct examples that access the sensitive environment variable `CREDITCLAW_API_KEY` and transmit it in network requests, but the document does not warn users to protect the key or note that the requests send authenticated wallet data to a remote service. Under the markdown-specific missing-warning criteria, credential use and remote status checks that expose financial information should be disclosed.

External Transmission

Medium

• Category: Data Exfiltration

Content

Before an expensive self-hosted card purchase, test if it would pass:

```bash
curl -X POST https://creditclaw.com/api/v1/bot/check/rail4/test \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "merchant_name": "Amazon", "amount_cents": 5000, "profile_index": 1 }'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest advertises a narrow purpose ('shop tickets online with owner approval'), but the skill actually exposes a general-purpose spending, payments, wallet, and merchant checkout platform. This scope mismatch can mislead users and security tooling into granting or approving a far broader set of financial capabilities than intended.

Session Persistence

Medium

• Category: Rogue Agent

Content

Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:
```bash
mkdir -p ~/.creditclaw/skills/creditcard
curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md
curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md
curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:
```bash
mkdir -p ~/.creditclaw/skills/creditcard
curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md
curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md
curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md
curl -s https://creditclaw.com/creditcard/prepaid-wallet.md > ~/.creditclaw/skills/creditcard/PREPAID-WALLET.md

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Transmission

Medium

• Category: Data Exfiltration

Content

Register to get your API key and a claim token for your human.

```bash
curl -X POST https://creditclaw.com/api/v1/bots/register \
  -H "Content-Type: application/json" \
  -d '{
    "bot_name": "my-research-bot",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Recommended interval: every 30 minutes, or before any purchase.

```bash
curl https://creditclaw.com/api/v1/bot/status \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"cash_advances"
  ],
  "recurring_allowed": false,
  "notes": "Prefer free tiers before paying. Always check for discount codes. No annual plans without asking me first.",
  "updated_at": "2026-02-06T18:00:00Z"
}
```

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.

• Confidence: 93% confidence
• Finding: The skill explicitly authorizes autonomous spending under certain approval modes and thresholds. Even with server-side guardrails, allowing an agent to spend without per-transaction human confirmation creates meaningful financial-risk exposure if the agent is manipulated, misaligned, or used in the wrong context.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.
- Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

• Confidence: 93% confidence
• Finding: Auto-approval by category permits the agent to independently spend within approved classes, which can still be abused through prompt injection, task confusion, or merchant/category misclassification. In a financial skill, this materially increases risk because real money can move without fresh human review.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `exceeds_per_transaction_limit` | 403 | Amount exceeds per-transaction cap. |
| `exceeds_daily_limit` | 403 | Would exceed daily spending limit. |
| `exceeds_monthly_limit` | 403 | Would exceed monthly spending limit. |
| `requires_owner_approval` | 403 | Amount above auto-approve threshold. |

When a purchase is declined, the response includes the relevant limits and your current
spending so you can understand why. Your owner is also notified of all declined attempts.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

External Transmission

Medium

• Category: Data Exfiltration

Content

When your balance is low, ask your human if they'd like you to request a top-up:

```bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill includes payment-link and money-collection functionality unrelated to the declared ticket-shopping use case. Adding unrelated financial capabilities increases attack surface and creates opportunities for misuse under the cover of an apparently narrow shopping skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Charging third parties via generated payment links is materially different from purchasing tickets and is not justified by the stated purpose. This can enable unauthorized billing workflows, social-engineering abuse, or hidden monetization behavior not expected by the owner.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Agent-to-agent and x402 blockchain payment/signing capabilities exceed the declared ticket-shopping scope and introduce higher-risk financial behaviors, including on-chain settlement and delegated signing. Such features broaden the blast radius if the skill is misused or misunderstood.

Static analysis

No suspicious patterns detected.