CitiBank Claw | Buy anyone online with CreditClaw

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.0.6

Overview

This is a disclosed financial-agent skill, but it needs Review because it can let an agent make real purchases and the marketplace banking-style branding is not supported by the CreditClaw artifacts.

Install only if you intentionally want this agent to have controlled financial authority. Verify the CreditClaw operator and any implied bank affiliation independently, require human approval by default, set tight spending/category/domain limits, avoid automatic heartbeat top-up requests, and protect CREDITCLAW_API_KEY like a payment credential.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

External Transmission

Medium

• Category: Data Exfiltration

Content

You can register before your human does. You'll get an API key immediately.

```bash
curl -X POST https://creditclaw.com/api/v1/bots/register \
  -H "Content-Type: application/json" \
  -d '{
    "bot_name": "my-research-bot",

• Confidence: 90% confidence
• Finding: This registration flow sends owner-identifying data such as email and bot metadata to an external service and returns a newly issued API key. Even though the destination is the declared vendor domain, this is still security-sensitive because it causes account creation and secret issuance based on model-driven decisions, which could occur without meaningful human review.

External Transmission

Medium

• Category: Data Exfiltration

Content

When your balance is low, ask your human if they'd like you to request a top-up:

```bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 87% confidence
• Finding: This endpoint triggers an external side effect by notifying the owner and initiating a funding workflow. While intended behavior for the product, it can still be abused by an autonomous agent to spam top-up requests or pressure a human into funding actions, especially if invoked from prompt-influenced task flow.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Make a Self-Hosted Card Checkout

```bash
curl -X POST https://creditclaw.com/api/v1/bot/merchant/checkout \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 93% confidence
• Finding: This endpoint initiates real-world card purchases through an external payment rail. Even with server-side guardrails and optional human approval, the skill enables financially consequential actions and could be abused if an agent is socially engineered, misaligned, or the auto-approval thresholds are too permissive.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Request x402 Payment Signature

```bash
curl -X POST https://creditclaw.com/api/v1/stripe-wallet/bot/sign \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 91% confidence
• Finding: This signing endpoint authorizes blockchain-based payments that can transfer value to third parties. Although guardrails are described, generating payment signatures remains a high-risk financial action, and an agent could be manipulated into paying an attacker-controlled recipient or resource if higher-level validation is weak.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "resource_url": "https://api.example.com/v1/data",
    "amount_usdc": 500000,
    "recipient_address": "0x1234...abcd"
  }'

• Confidence: 78% confidence
• Finding: The example permits the agent to submit an arbitrary external resource_url for payment signing. That creates SSRF-like and confused-deputy risk at the workflow level, because a model could be induced to authorize payment for attacker-chosen endpoints or domains not meaningfully tied to the intended service.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.

• Confidence: 89% confidence
• Finding: This explicitly authorizes the agent to make autonomous spending decisions under certain thresholds. Even with owner-configured limits, granting a model discretion to spend creates real financial risk from prompt injection, manipulation, or poor categorization, especially when combined with external merchant interactions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.
- Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

• Confidence: 89% confidence
• Finding: Auto-approval by category broadens model autonomy from simple thresholds to semantic classification of purchases. A model can misclassify or be induced to frame a questionable purchase as an approved category, causing unauthorized or unintended spending despite server-side enforcement.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. You submit a checkout request with merchant and amount details
2. CreditClaw evaluates the request against your card's permissions
3. If the amount is within your auto-approved allowance, it processes immediately
4. If the amount exceeds the threshold, your owner receives an approval request (email with secure link)
5. You poll for the result
6. Once approved, the transaction is recorded

• Confidence: 88% confidence
• Finding: The self-hosted card flow allows immediate processing when within an auto-approved allowance, enabling autonomous card-funded purchases. This is dangerous because it converts model decisions directly into real charges, and the human approval safeguard is bypassed for anything under the configured threshold.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.