Security audit

CitiBank Claw | Buy anyone online with CreditClaw

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed financial wallet skill, but it should be reviewed carefully because it gives agents broad money-moving authority and treats remote free-form notes as instructions.

Install only if you trust CreditClaw and intend to let an agent handle real financial workflows. Use strict owner controls, prefer ask-before-everything approval, keep the API key in a secrets manager, avoid putting broad commands in the remote notes field, and do not use the mutable curl install path unless you can verify the files you are installing. Be careful before submitting payer emails or full resource URLs that may contain private information.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: skill.md:35
Finding: Unpinned Remote Skill Installation Allows Supply-Chain Instruction Replacement
Content: View full analysis
Vulnerability Details

File Location: skill.md, lines 35-40
Vulnerability Type: Unverified installation of mutable remote Skill files
Risk Level: Medium

Vulnerable Code

bash
**Install locally:** ```bash mkdir -p ~/.creditclaw/skills/creditclaw curl -s https://creditclaw.com/skill.md > ~/.creditclaw/skills/creditclaw/SKILL.md curl -s https://creditclaw.com/heartbeat.md > ~/.creditclaw/skills/creditclaw/HEARTBEAT.md curl -s https://creditclaw.com/skill.json > ~/.creditclaw/skills/creditclaw/package.json

text
### Technical Analysis The installation procedure downloads mutable files from the vendor-controlled server directly into the Agent's local Skill directory. It does not use an immutable versioned URL, verify a cryptographic signature or checksum, or require inspection before replacing local Skill instructions. Although the downloaded files are primarily Markdown and JSON rather than conventional executable binaries, Skill text is an effective Agent control surface. Instructions loaded from `SKILL.md` and `HEARTBEAT.md` can influence network requests, credential handling, financial operations, and future Agent behavior. Consequently, changing these files after review can change the effective payload of the Skill. HTTPS protects traffic in transit under ordinary conditions, but it does not protect against compromise of the vendor server, deployment pipeline, CDN, DNS infrastructure, or publishing credentials. The use of `curl -s` also suppresses diagnostics, while the absence of `--fail` can cause an HTTP error response to overwrite a valid local Skill file. ### Attack Path 1. An attacker compromises the CreditClaw publishing infrastructure, hosting account, CDN, DNS path, or another component capable of modifying the files served from `creditclaw.com`. 2. The attacker replaces one or more remotely hosted Skill files with malicious Agent instructions. 3. A user follows the documented ins ...[truncated 1331 chars]
Remediation: View remediation
Remediation Suggestions

Publish immutable, version-specific artifact URLs rather than installing from mutable latest-version paths.

Publish SHA-256 or stronger cryptographic digests through an independently protected channel and verify them before replacing local files.

Prefer signed release manifests and verify signatures against a pinned public key.

Download into a temporary file, verify integrity and expected content type, and only then atomically replace the installed file.

Use curl --fail --show-error --location rather than silent downloads that can overwrite files with HTTP error pages.

Require explicit review or confirmation before updating an already installed Skill.

Retain the previous known-good version so a failed or suspicious update can be rolled back.

Restrict the Skill runtime so loaded instructions cannot access unrelated credentials, files, or tools.

T01 · Skill Instruction Hijacking

Warning

Location: skill.md:278
Finding: Unrestricted Server-Provided Notes Are Elevated to Agent Instructions
Content: View full analysis
Vulnerability Details

File Location: skill.md, lines 278-290
Vulnerability Type: Untrusted remote data treated as authoritative Agent instructions
Risk Level: Medium

Vulnerable Code

markdown
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

The same unsafe trust rule is reinforced in heartbeat.md, lines 57-61:

markdown
**Key fields to act on:** - `approval_mode` — determines whether you can auto-spend or must ask first - `blocked_categories` — never attempt purchases in these categories - `notes` — read and follow these; they are direct instructions from your owner - `updated_at` — if this changed since your last check, re-read all fields

Technical Analysis

The Skill directs the Agent to retrieve a free-form notes value from a remote API and “always read and follow” it as the owner's direct instructions. No semantic boundary limits the field to financial policy, and no rule states that the content must be treated as untrusted data or must not override higher-priority instructions and safety constraints.

This creates an indirect prompt-injection channel. Any party able to alter the returned notes value—including an attacker who compromises the owner's account or the CreditClaw service—could place operational instructions ...[truncated 2269 chars]
Remediation: View remediation
Remediation Suggestions

Treat notes strictly as untrusted transaction-policy data, not as general Agent instructions.

Explicitly state that notes cannot override system instructions, user intent, security policies, approval requirements, or tool-use restrictions.

Replace unrestricted free-form directives with a structured, validated policy schema containing narrowly defined fields.

Enforce server-side length limits, allowed character sets, and semantic validation.

Reject or ignore notes that request credential disclosure, unrelated network access, file access, command execution, policy changes, or actions outside the current financial transaction.

Display unexpected or action-oriented notes to the authenticated owner and require separate confirmation before acting.

Record and expose note changes through an auditable owner-facing history.

Apply the same trust-boundary language in both skill.md and heartbeat.md so the periodic routine cannot reintroduce the unsafe behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (20)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · skill.md (reported line 21)May include surrounding context.
md
's rules, (4) request a top-up from your owner, (5) generate a payment link to charge anyone for a service you performed, (6) view your transaction history, or (7) use self-hosted card checkout with human approval workflows. homepage: https://creditclaw.com api_base: https://creditclaw.com/api/v1 credentials: [CREDITCLAW_API_KEY] --- # CreditClaw — Financial Enablement & Accounting for AI Agents CreditClaw.com is a financial enablement & accounting platform for Bots, Agents, and OpenClaw. It provides multiple methods for enabling and managing agentic spending and purchases, and offers consolidated accounts and guardrails on transactions across wallets. ## Skill Files | File | URL | Purpose | |------|-----|---------| | **SKILL.md** (this file) | `https://creditclaw.com/skill.md` | Full API reference and registration instructions | | **HEARTBEAT.md** | `https://creditclaw.com/heartbeat.md` | Lightweight polling routine for balance and spending checks | | **package.json** (m

External Transmission

Medium

Category: Data Exfiltration
Confidence: 82% confidence
Finding: This skill instructs the agent to send an authenticated request containing a bearer token to an external service to retrieve wallet status. External transmission is expected for this integration, but it is still security-relevant because it exposes account metadata off-agent and normalizes routine credentialed network access without any warning about what information is being sent or how the endpoint is trusted.
Content: Scanner excerpt · heartbeat.md (reported line 18)May include surrounding context.
1. Check Wallet Status

bash
curl https://creditclaw.com/api/v1/bot/wallet/check \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill directs the agent to make authenticated API calls and, when balance is low, to automatically initiate a funding-related POST request to request a top-up. Even though this appears to be intended product functionality, it causes transmission of account state and triggers a financial workflow without an explicit consent checkpoint or clear warning that the agent is performing a funding action, which increases the risk of unintended financial operations or social-engineering pressure on the human owner.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skill.md (reported line 37)May include surrounding context.
Install locally:

bash
mkdir -p ~/.creditclaw/skills/creditclaw curl -s https://creditclaw.com/skill.md > ~/.creditclaw/skills/creditclaw/SKILL.md curl -s https://creditclaw.com/heartbeat.md > ~/.creditclaw/skills/creditclaw/HEARTBEAT.md curl -s https://creditclaw.com/skill.json > ~/.creditclaw/skills/creditclaw/package.json

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · skill.md (reported line 38)May include surrounding context.
Install locally:

bash
mkdir -p ~/.creditclaw/skills/creditclaw curl -s https://creditclaw.com/skill.md > ~/.creditclaw/skills/creditclaw/SKILL.md curl -s https://creditclaw.com/heartbeat.md > ~/.creditclaw/skills/creditclaw/HEARTBEAT.md curl -s https://creditclaw.com/skill.json > ~/.creditclaw/skills/creditclaw/package.json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 117)May include surrounding context.
You can register before your human does. You'll get an API key immediately.

bash
curl -X POST https://creditclaw.com/api/v1/bots/register \ -H "Content-Type: application/json" \ -d '{ "bot_name": "my-research-bot",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 253)May include surrounding context.
and can update them anytime from their dashboard.

bash
curl https://creditclaw.com/api/v1/bot/wallet/spending \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skill.md (reported line 279)May include surrounding context.
"cash_advances" ], "recurring_allowed": false, "notes": "Prefer free tiers before paying. Always check for discount codes. No annual plans without asking me first.", "updated_at": "2026-02-06T18:00:00Z" }

text

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skill.md (reported line 286)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skill.md (reported line 287)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skill.md (reported line 344)May include surrounding context.
md
| `exceeds_per_transaction_limit` | 403 | Amount exceeds per-transaction cap. | | `exceeds_daily_limit` | 403 | Would exceed daily spending limit. | | `exceeds_monthly_limit` | 403 | Would exceed monthly spending limit. | | `requires_owner_approval` | 403 | Amount above auto-approve threshold. | When a purchase is declined, the response includes the relevant limits and your current spending so you can understand why. Your owner is also notified of all declined attempts.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skill.md (reported line 494)May include surrounding context.
md
| `exceeds_per_transaction_limit` | 403 | Amount exceeds per-transaction cap. | | `exceeds_daily_limit` | 403 | Would exceed daily spending limit. | | `exceeds_monthly_limit` | 403 | Would exceed monthly spending limit. | | `requires_owner_approval` | 403 | Amount above auto-approve threshold. | When a purchase is declined, the response includes the relevant limits and your current spending so you can understand why. Your owner is also notified of all declined attempts.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skill.md (reported line 527)May include surrounding context.
md
| `exceeds_per_transaction_limit` | 403 | Amount exceeds per-transaction cap. | | `exceeds_daily_limit` | 403 | Would exceed daily spending limit. | | `exceeds_monthly_limit` | 403 | Would exceed monthly spending limit. | | `requires_owner_approval` | 403 | Amount above auto-approve threshold. | When a purchase is declined, the response includes the relevant limits and your current spending so you can understand why. Your owner is also notified of all declined attempts.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 356)May include surrounding context.
When your balance is low, ask your human if they'd like you to request a top-up:

bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The payment-link example includes an optional payer_email field but does not warn that supplying a third party's email discloses personal data to the CreditClaw service and its payment processor. This can lead agents to transmit client contact information without explicit consent or data-minimization guidance.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 502)May include surrounding context.
Make a Self-Hosted Card Checkout

bash
curl -X POST https://creditclaw.com/api/v1/bot/merchant/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 596)May include surrounding context.
Request x402 Payment Signature

bash
curl -X POST https://creditclaw.com/api/v1/stripe-wallet/bot/sign \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The skill instructs the agent to send an arbitrary third-party resource_url to CreditClaw for signing without emphasizing strict validation of that destination or the privacy implications of sharing full URLs. If those URLs contain sensitive path/query data, the agent may disclose internal endpoints, tokens, or task-specific information to the payment service.
Content: Scanner excerpt · skill.md (reported line 600)May include surrounding context.
md
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "resource_url": "https://api.example.com/v1/data", "amount_usdc": 500000, "recipient_address": "0x1234...abcd" }'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 624)May include surrounding context.
Use the x_payment_header value as-is in your retry request:

bash
curl https://api.example.com/v1/data \ -H "X-PAYMENT: eyJ0eXAiOi..."

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description advertises broad financial capabilities such as wallet funding, purchases, top-ups, payment collection, and transaction history without clearly restricting invocation conditions or requiring strong user confirmation boundaries. In an agent ecosystem, an overly broad skill description can cause inappropriate tool selection for sensitive money-moving actions, increasing the risk of unintended spending, charging, or disclosure of financial data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

External Transmission

1. Check Wallet Status

Missing User Warnings

Session Persistence

Skill Enumeration

External Transmission

External Transmission

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

External Transmission

Missing User Warnings

External Transmission

Make a Self-Hosted Card Checkout

External Transmission

Request x402 Payment Signature

External Transmission

External Transmission

Vague Triggers

Static analysis