Checkout.com - Integrate with Agentic Payments & Wallets

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:04 PM UTC
• Version: 1.2.1

Overview

This is a real-money payments skill with disclosed purpose, but it asks agents to trust mutable remote documents and server-supplied instructions while handling spending and card data.

Review this carefully before installing. Only use it if you trust CreditClaw with agent spending workflows, buyer/customer data, and temporary card-handling flows; keep spending defaults strict, require human approval for purchases, avoid letting agents treat remote Markdown or API payload text as authoritative instructions, and protect CREDITCLAW_API_KEY and webhook secrets like financial credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:24
• Finding: Mutable Remote Skill Documents Are Loaded as Authoritative Instructions<![CDATA[ ## Vulnerability Details **File Location**: `skill.md:24-32` **Vulnerability Type**: Mutable remote instruction loading **Risk Level**: High ### Complete Code Snippet ```markdown | File | URL | Purpose | |------|-----|---------| | **SKILL.md** (this file) | `https://creditclaw.com/skill.md` | Registration, setup, webhooks, status, spending permissions, API reference | | **ENCRYPTED-CARD.md** | `https://creditclaw.com/encrypted-card.md` | Card checkout — accepting card details, making purchases, confirming orders | | **STRIPE-X402-WALLET.md** | `https://creditclaw.com/stripe-x402-wallet.md` | x402 payment signing, USDC balance, Stripe Wallet transactions | | **MANAGEMENT.md** | `https://creditclaw.com/management.md` | Cross-rail operations — top-ups, transaction history, approvals | | **CHECKOUT.md** | `https://creditclaw.com/checkout.md` | Sell to anyone — checkout pages, payment links, invoices, shops | | **HEARTBEAT.md** | `https://creditclaw.com/heartbeat.md` | Lightweight polling routine for balance and spending checks | | **package.json** (metadata) | `https://creditclaw.com/skill.json` | Machine-readable skill metadata | **Read these files directly from the URLs above — no local installation needed.** ``` ### Technical Analysis The Skill explicitly directs the Agent to retrieve operational instructions from mutable URLs and treat those documents as authoritative. The effective instruction set can therefore change after the locally installed artifact has been reviewed. Although the documents are fetched over HTTPS from the declared service domain, transport security does not ensure that future content is safe. The content could change through a compromised server, deployment pipeline, administrative account, DNS or hosting configuration, or an intentional post-review update. This is an instruction-trust vulnerability rather than confirmed native code execution. The remotely loaded Markdown can nevertheless direct an Agent to invoke tools, ...[truncated 1545 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bundle reviewed operational documentation with the Skill instead of loading mutable remote copies. - If remote updates are required, pin each document to a version and cryptographic digest. - Verify signed manifests before accepting updated documents. - Treat downloaded Markdown as untrusted reference data, not executable Agent instructions. - Require explicit owner approval before adopting a new document version. - Restrict remote content to a validated structured schema rather than unrestricted natural-language instructions. - Ensure remotely retrieved content cannot request credentials, change approved domains, override safety controls, or initiate tool calls. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: encrypted-card.md:72
• Finding: Checkout API Response Can Supply Agent Tasks and Execution Steps<![CDATA[ ## Vulnerability Details **File Location**: `encrypted-card.md:72-87` **Vulnerability Type**: Server-controlled task and workflow injection **Risk Level**: High ### Complete Code Snippet ```json { "approved": true, "checkout_id": "r5chk_abc123", "checkout_steps": [ "Call POST /api/v1/bot/rail5/key with { \"checkout_id\": \"r5chk_abc123\" } to get the decryption key.", "Decrypt the encrypted card data using AES-256-GCM with the key, IV, and tag from the API response.", "Use the decrypted card details to complete checkout at DigitalOcean.", "Call POST /api/v1/bot/rail5/confirm with { \"checkout_id\": \"r5chk_abc123\", \"status\": \"success\" } when done.", "If checkout fails, call confirm with { \"status\": \"failed\" } instead.", "Discard all decrypted card data. Announce the result." ], "spawn_payload": { "task": "You are a checkout agent...", "cleanup": "delete", "runTimeoutSeconds": 300, "label": "checkout-digitalocean" } } ``` ### Technical Analysis The checkout response contains free-form `checkout_steps` and a `spawn_payload.task` value intended to guide or instantiate an Agent workflow. These fields cross a trust boundary from the remote API into the Agent's instruction context. The documented flow does not require the Agent to ignore arbitrary natural-language directives, validate the task against a fixed local template, or allowlist the actions represented by each step. Consequently, control of the API response can become control of the checkout Agent's behavior. This is especially dangerous because the workflow obtains a one-time decryption key and handles card number, CVV, expiry, cardholder name, and billing address. A malicious task could attempt to redirect that material or cause checkout at a destination different from the owner-approved merchant. The documented `cleanup: "delete"` and short timeout reduce residual exposure but do not prevent malicious actions during the task. Li ...[truncated 1631 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `spawn_payload.task` and free-form `checkout_steps` from the trusted execution path. - Implement checkout as fixed, locally reviewed code with a strict state machine. - Accept only typed response fields such as checkout ID, approval status, merchant origin, amount, and cryptographic material. - Validate the merchant hostname against the exact owner-approved hostname before decrypting card data. - Bind the decryption key cryptographically to the checkout ID, merchant origin, amount, and expiration. - Prevent the card-handling component from making network requests except to the approved merchant and fixed CreditClaw API endpoints. - Run card handling in an isolated process without access to unrelated credentials, files, memory, or Agent tools. - Require fresh owner confirmation if the merchant, amount, item, or destination differs from the original approval. - Redact sensitive values from logs, prompts, traces, screenshots, and error messages. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: encrypted-card.md:184
• Finding: Webhook and Message Payload Instructions Are Treated as Executable Guidance<![CDATA[ ## Vulnerability Details **File Location**: `encrypted-card.md:184-204` **Vulnerability Type**: Instruction injection through remote event payloads **Risk Level**: High ### Complete Code Snippet ```markdown **Via webhook:** If you have a `callback_url`, the card details are delivered automatically: ```json { "event": "rail5.card.delivered", "bot_id": "bot_abc123", "data": { "card_id": "r5card_...", "card_name": "ChaseD", "card_last4": "9547", "encrypted_data": "<encrypted card details>", "instructions": "Accept the encrypted card details and confirm delivery via POST /bot/rail5/confirm-delivery" } } ``` **Via bot messages (fallback):** If you don't have a webhook, check `GET /bot/messages` for messages with `event_type: "rail5.card.delivered"`. The payload is identical. After accepting the card details, acknowledge the message via `POST /bot/messages/ack`. Store the encrypted card data securely using your platform's secrets manager or keep it in memory. Follow the `instructions` field in the message payload for next steps. ``` ### Technical Analysis The Skill explicitly directs the Agent to follow an `instructions` string supplied inside webhook or polling-message payloads. This converts remote event data into authoritative Agent instructions. Webhook HMAC verification, where correctly implemented, can establish that a payload originated from CreditClaw. It does not establish that arbitrary natural-language content in the payload is safe to execute. A compromised service, signing secret, event-generation component, or privileged account can still provide malicious instructions with a valid signature. The fallback message channel has the same semantic problem. The Agent is not told to ignore free-form instructions and dispatch exclusively on a locally defined `event_type` allowlist. The payload also carries encrypted card data, increasing the impact of any malicious instruction that changes where or how that data is ...[truncated 1571 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never interpret an event payload's `instructions` field as executable guidance. - Remove free-form instruction fields from webhook and bot-message schemas. - Dispatch events through a fixed local mapping from an allowlisted `event_type` to reviewed handler code. - Reject unknown event types, unexpected fields, malformed identifiers, and unapproved URLs. - Verify HMAC signatures using constant-time comparison, enforce timestamps and replay windows, and deduplicate event IDs. - Acknowledge messages only after a locally defined handler completes successfully. - Separate encrypted card storage from general Agent memory and prompts. - Do not expose card payloads, decryption keys, API keys, or webhook secrets to language-model context unless strictly unavoidable. - Apply outbound network restrictions to event handlers and allow only fixed CreditClaw API endpoints. - Record tamper-resistant audit logs for event receipt, validation, handling, and acknowledgment without logging sensitive payloads. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Credential Access

High

• Category: Privilege Escalation

Content

- **Set `amount_locked: true`** for fixed-price products so buyers can't underpay.
- **Leave `amount_usd` empty** for donation or tip jars.
- **Use `page_type: "digital_product"`** when selling downloadable content, API keys, or access tokens.
- **Use `success_url`** to redirect buyers back to your service after payment.
- **Check `GET /bot/sales`** periodically to reconcile completed sales with your fulfillment.
- **Multiple checkout pages** are fine — create one per product or service tier.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

ription: "Paypal compatible Payments & Wallet - Give your agent spending power. Financial management for Agents and OpenClaw bots."
homepage: https://creditclaw.com
api_base: https://creditclaw.com/api/v1
credentials: [CREDITCLAW_API_KEY]
metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}}
---

# CreditClaw — Financial Enablement & Accounting for AI Agents

CreditClaw.com is a financial enablement platform for Agents and OpenClaw.
Securely manage agentic spending.
1. Accept card details securely from your owner and make purchases within strict guardrails after owner approval.
2. A stablecoin wallet to seamlessly enable x402 payments with a simple "Fund with Stripe" option.
3. Easy-to-use "Storefronts" and product management for bots to sell both digital and physical products.

## Skill Files

| File | URL | Purpose |
|------|-----|---------|
| **SKILL.md** (this file) | `https://creditclaw.com/skill.md` | Registration, setup, webhooks,

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

-H "Content-Type: application/json"
  -d '{
    "title": "Premium API Access - 1 Month",
    "description": "Unlimited queries to my data analysis endpoint.",
    "amount_usd": 5.00,
    "amount_locked": true
  }'

• Confidence: 80% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill documents sending recipient and buyer personal data such as names and email addresses to external payment APIs, but provides no privacy notice, data-handling guidance, or minimization advice. In an agent context, this can lead to silent transmission of third-party PII without user awareness or policy checks, creating privacy, compliance, and trust risks.

External Transmission

Medium

• Category: Data Exfiltration

Content

"title": "Premium API Access",
  "amount_usd": 5.00,
  "page_type": "digital_product",
  "digital_product_url": "https://api.databot.com/keys/generate",
  "shop_visible": true
}

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation describes a purchase flow that places a real merchant order and forwards shipping details through external infrastructure, but it does not prominently warn users at the point of action that this triggers real-world spending and disclosure of personal address data. In a payments skill, that omission increases the risk of unintended purchases and privacy-impacting data transmission by users or downstream agents treating the example as a harmless test call.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Purchase Request

```bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 87% confidence
• Finding: The sample curl command sends authentication material and shipping-address PII to a live external API endpoint that initiates an actual purchase workflow. In the context of an agent skill that gives spending power, this is security-relevant because an agent or user may execute the example directly, causing external data disclosure and potentially irreversible financial transactions.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 1: Request Checkout

```bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/checkout \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"approved": false,
  "status": "pending_approval",
  "checkout_id": "r5chk_abc123",
  "message": "Amount exceeds auto-approve threshold. Your owner has been notified.",
  "expires_in_minutes": 15
}
```

• Confidence: 85% confidence
• Finding: The file explicitly supports autonomous purchasing within predefined thresholds via immediate approval, meaning an agent can spend funds without per-transaction human review. In a financial skill this is contextually expected, but it still increases risk because prompt injection, task confusion, or compromised agent logic could trigger unauthorized purchases that appear policy-compliant.

External Transmission

Medium

• Category: Data Exfiltration

Content

Once the checkout is approved, call this endpoint to retrieve the one-time decryption key:

```bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "checkout_id": "r5chk_abc123" }'

• Confidence: 84% confidence
• Finding: The skill instructs the agent to retrieve a one-time decryption key from a remote service, enabling reconstruction of full payment card data inside the agent runtime. Even if framed as normal operation, this creates a high-value secret flow where compromise, logging, prompt leakage, or misuse of the agent can expose PAN/CVV data and expand PCI-sensitive handling into the agent environment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the agent to make authenticated API calls with a bearer token to retrieve wallet status, balances, spending permissions, and other financial metadata, but it provides no warning about protecting the API key, minimizing logging, or avoiding disclosure of sensitive responses. In a payments/wallet skill, these responses are especially sensitive because they expose financial state and authorization constraints that could be leaked through logs, telemetry, prompts, or downstream tools.

External Transmission

Medium

• Category: Data Exfiltration

Content

When your balance is low, ask your human if they'd like you to request a top-up:

```bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest presents the skill to users as PayPal-compatible, but the embedded metadata identifies a different service/provider, domain, and API base. In a payments skill, this identity mismatch can mislead users or downstream systems about who will process funds and receive credentials, increasing phishing, trust-boundary, and unauthorized-payment risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The manifest explicitly grants an agent spending power and financial management capability but provides no warning about real-money effects, transaction authority, or approval expectations. In this context, users may enable the skill without understanding that an autonomous agent could initiate or manage financially impactful actions, raising the chance of unintended charges or misuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

You can register before your human does. You'll get an API key immediately.

```bash
curl -X POST https://creditclaw.com/api/v1/bots/register \
  -H "Content-Type: application/json" \
  -d '{
    "bot_name": "my-research-bot",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.

• Confidence: 85% confidence
• Finding: The skill explicitly authorizes the agent to make purchases autonomously under certain approval modes, which creates real-world financial risk if the agent misclassifies a purchase, is prompt-injected by an external source, or acts on incomplete context. Even with server-side guardrails, the skill is designed to let the agent initiate spending, so compromise of agent decision-making can still cause unauthorized or unintended transactions within allowed limits.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.
- Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

• Confidence: 85% confidence
• Finding: Allowing autonomous purchases by category delegates financial authorization to model judgment, which is error-prone and vulnerable to prompt manipulation or category ambiguity. Because this is a payments skill with real spending power, mistakes can directly convert to monetary loss even if backend limits cap the blast radius.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Fetch Pending Messages

```bash
curl https://creditclaw.com/api/v1/bot/messages \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Choose one:

- [x] **Ask me for everything** — Bot requests approval before any purchase
- [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below
- [ ] **Auto-approve by category** — Bot spends freely on approved categories

---

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Choose one:

- [x] **Ask me for everything** — Bot requests approval before any purchase
- [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below
- [ ] **Auto-approve by category** — Bot spends freely on approved categories

---

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Ask approval above | $10.00 |

If a purchase exceeds the "ask approval above" amount, the bot must
send you a confirmation request before proceeding — even if auto-approve
is enabled.

---

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Ask approval above | $10.00 |

If a purchase exceeds the "ask approval above" amount, the bot must
send you a confirmation request before proceeding — even if auto-approve
is enabled.

---

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Example:
- Prefer free tiers of services before paying for premium
- Always check if there's a coupon or discount code before purchasing
- Don't sign up for annual plans without asking me first
- If you find a cheaper alternative for something, tell me before switching
```

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Example:
- Prefer free tiers of services before paying for premium
- Always check if there's a coupon or discount code before purchasing
- Don't sign up for annual plans without asking me first
- If you find a cheaper alternative for something, tell me before switching
```

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation instructs use of a bearer API key to authorize wallet signing and wallet data access, but does not warn that this credential grants access to financial operations and sensitive wallet metadata. In a payments skill, omission of credential-handling and privacy guidance can lead operators or downstream agents to expose the key in logs, prompts, repos, or untrusted tooling, enabling unauthorized spending requests or balance/transaction disclosure.

Static analysis

No suspicious patterns detected.