T01 · Skill Instruction Hijacking
Error
- Location
skill.md:24- Finding
Mutable Remote Skill Documents Are Loaded as Authoritative Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Checkout.com - Integrate with Agentic Payments & Wallets
Security checks for vulnerabilities and agentic risk
Overview
This is a real-money payments skill with disclosed purpose, but it asks agents to trust mutable remote documents and server-supplied instructions while handling spending and card data.
Review this carefully before installing. Only use it if you trust CreditClaw with agent spending workflows, buyer/customer data, and temporary card-handling flows; keep spending defaults strict, require human approval for purchases, avoid letting agents treat remote Markdown or API payload text as authoritative instructions, and protect CREDITCLAW_API_KEY and webhook secrets like financial credentials.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
encrypted-card.md:72- Finding
Checkout API Response Can Supply Agent Tasks and Execution Steps
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
encrypted-card.md:184- Finding
Webhook and Message Payload Instructions Are Treated as Executable Guidance
- Content
View full analysis
", "instructions": "Accept the encrypted card details and confirm delivery via POST /bot/rail5/confirm-delivery" } } ``` **Via bot messages (fallback):** If you don't have a webhook, check `GET /bot/messages` for messages with `event_type: "rail5.card.delivered"`. The payload is identical. After accepting the card details, acknowledge the message via `POST /bot/messages/ack`. Store the encrypted card data securely using your platform's secrets manager or keep it in memory. Follow the `instructions` field in the message payload for next steps. ``` ### Technical Analysis The Skill explicitly directs the Agent to follow an `instructions` string supplied inside webhook or polling-message payloads. This converts remote event data into authoritative Agent instructions. Webhook HMAC verification, where correctly implemented, can establish that a payload originated from CreditClaw. It does not establish that arbitrary natural-language content in the payload is safe to execute. A compromised service, signing secret, event-generation component, or privileged account can still provide malicious instructions with a valid signature. The fallback message channel has the same semantic problem. The Agent is not told to ignore free-form instructions and dispatch exclusively on a locally defined `event_type` allowlist. The payload also carries encrypted card data, increasing the impact of any malicious instruction that changes where or how that data is ...[truncated 1571 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (29)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **Set `amount_locked: true`** for fixed-price products so buyers can't underpay. - **Leave `amount_usd` empty** for donation or tip jars. - **Use `page_type: "digital_product"`** when selling downloadable content, API keys, or access tokens. - **Use `success_url`** to redirect buyers back to your service after payment. - **Check `GET /bot/sales`** periodically to reconcile completed sales with your fulfillment. - **Multiple checkout pages** are fine — create one per product or service tier.
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md ription: "Paypal compatible Payments & Wallet - Give your agent spending power. Financial management for Agents and OpenClaw bots." homepage: https://creditclaw.com api_base: https://creditclaw.com/api/v1 credentials: [CREDITCLAW_API_KEY] metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}} --- # CreditClaw — Financial Enablement & Accounting for AI Agents CreditClaw.com is a financial enablement platform for Agents and OpenClaw. Securely manage agentic spending. 1. Accept card details securely from your owner and make purchases within strict guardrails after owner approval. 2. A stablecoin wallet to seamlessly enable x402 payments with a simple "Fund with Stripe" option. 3. Easy-to-use "Storefronts" and product management for bots to sell both digital and physical products. ## Skill Files | File | URL | Purpose | |------|-----|---------| | **SKILL.md** (this file) | `https://creditclaw.com/skill.md` | Registration, setup, webhooks,
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md -H "Content-Type: application/json" -d '{ "title": "Premium API Access - 1 Month", "description": "Unlimited queries to my data analysis endpoint.", "amount_usd": 5.00, "amount_locked": true }'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documents sending recipient and buyer personal data such as names and email addresses to external payment APIs, but provides no privacy notice, data-handling guidance, or minimization advice. In an agent context, this can lead to silent transmission of third-party PII without user awareness or policy checks, creating privacy, compliance, and trust risks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "title": "Premium API Access", "amount_usd": 5.00, "page_type": "digital_product", "digital_product_url": "https://api.databot.com/keys/generate", "shop_visible": true }
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation describes a purchase flow that places a real merchant order and forwards shipping details through external infrastructure, but it does not prominently warn users at the point of action that this triggers real-world spending and disclosure of personal address data. In a payments skill, that omission increases the risk of unintended purchases and privacy-impacting data transmission by users or downstream agents treating the example as a harmless test call.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The sample curl command sends authentication material and shipping-address PII to a live external API endpoint that initiates an actual purchase workflow. In the context of an agent skill that gives spending power, this is security-relevant because an agent or user may execute the example directly, causing external data disclosure and potentially irreversible financial transactions.
- Content
Purchase Request
bash curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Request Checkout
bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The file explicitly supports autonomous purchasing within predefined thresholds via immediate approval, meaning an agent can spend funds without per-transaction human review. In a financial skill this is contextually expected, but it still increases risk because prompt injection, task confusion, or compromised agent logic could trigger unauthorized purchases that appear policy-compliant.
- Content
"approved": false, "status": "pending_approval", "checkout_id": "r5chk_abc123", "message": "Amount exceeds auto-approve threshold. Your owner has been notified.", "expires_in_minutes": 15 }
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The skill instructs the agent to retrieve a one-time decryption key from a remote service, enabling reconstruction of full payment card data inside the agent runtime. Even if framed as normal operation, this creates a high-value secret flow where compromise, logging, prompt leakage, or misuse of the agent can expose PAN/CVV data and expand PCI-sensitive handling into the agent environment.
- Content
Once the checkout is approved, call this endpoint to retrieve the one-time decryption key:
bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123" }'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to make authenticated API calls with a bearer token to retrieve wallet status, balances, spending permissions, and other financial metadata, but it provides no warning about protecting the API key, minimizing logging, or avoiding disclosure of sensitive responses. In a payments/wallet skill, these responses are especially sensitive because they expose financial state and authorization constraints that could be leaked through logs, telemetry, prompts, or downstream tools.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
When your balance is low, ask your human if they'd like you to request a top-up:
bash curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest presents the skill to users as PayPal-compatible, but the embedded metadata identifies a different service/provider, domain, and API base. In a payments skill, this identity mismatch can mislead users or downstream systems about who will process funds and receive credentials, increasing phishing, trust-boundary, and unauthorized-payment risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest explicitly grants an agent spending power and financial management capability but provides no warning about real-money effects, transaction authority, or approval expectations. In this context, users may enable the skill without understanding that an autonomous agent could initiate or manage financially impactful actions, raising the chance of unintended charges or misuse.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
You can register before your human does. You'll get an API key immediately.
bash curl -X POST https://creditclaw.com/api/v1/bots/register \ -H "Content-Type: application/json" \ -d '{ "bot_name": "my-research-bot",
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The skill explicitly authorizes the agent to make purchases autonomously under certain approval modes, which creates real-world financial risk if the agent misclassifies a purchase, is prompt-injected by an external source, or acts on incomplete context. Even with server-side guardrails, the skill is designed to let the agent initiate spending, so compromise of agent decision-making can still cause unauthorized or unintended transactions within allowed limits.
- Content
md **You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Allowing autonomous purchases by category delegates financial authorization to model judgment, which is error-prone and vulnerable to prompt manipulation or category ambiguity. Because this is a payments skill with real spending power, mistakes can directly convert to monetary loss even if backend limits cap the blast radius.
- Content
md **You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Fetch Pending Messages
bash curl https://creditclaw.com/api/v1/bot/messages \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Choose one: - [x] **Ask me for everything** — Bot requests approval before any purchase - [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below - [ ] **Auto-approve by category** — Bot spends freely on approved categories ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Choose one: - [x] **Ask me for everything** — Bot requests approval before any purchase - [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below - [ ] **Auto-approve by category** — Bot spends freely on approved categories ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Ask approval above | $10.00 | If a purchase exceeds the "ask approval above" amount, the bot must send you a confirmation request before proceeding — even if auto-approve is enabled. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Ask approval above | $10.00 | If a purchase exceeds the "ask approval above" amount, the bot must send you a confirmation request before proceeding — even if auto-approve is enabled. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
Example:
- Prefer free tiers of services before paying for premium
- Always check if there's a coupon or discount code before purchasing
- Don't sign up for annual plans without asking me first
- If you find a cheaper alternative for something, tell me before switching
text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
Example:
- Prefer free tiers of services before paying for premium
- Always check if there's a coupon or discount code before purchasing
- Don't sign up for annual plans without asking me first
- If you find a cheaper alternative for something, tell me before switching
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation instructs use of a bearer API key to authorize wallet signing and wallet data access, but does not warn that this credential grants access to financial operations and sensitive wallet metadata. In a payments skill, omission of credential-handling and privacy guidance can lead operators or downstream agents to expose the key in logs, prompts, repos, or untrusted tooling, enabling unauthorized spending requests or balance/transaction disclosure.
- Content