Security audit

CreditClaw - Give your Claw Agent a credit card - spend anywhere

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed payment/shopping integration, but it gives an agent broad financial powers that deserve manual review before installation.

Review this carefully before installing. Only use it with a dedicated CreditClaw API key, conservative spending limits, human approval by default, narrow merchant/category allowlists, and clear rules for payment links and x402 signing. Treat successful purchase, checkout, and signing calls as real financial actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (26)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · skill.md (reported line 12)May include surrounding context.
md
rsion: 2.3.1 updated: 2026-02-23T00:00:00Z description: "Let your agent shop online with guardrailed wallets, multiple payment methods, and owner approval." homepage: https://creditclaw.com api_base: https://creditclaw.com/api/v1 credentials: [CREDITCLAW_API_KEY] metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}} --- # CreditClaw — Shopping for AI Agents CreditClaw lets your agent buy things online — Amazon products, Shopify stores, SaaS subscriptions, and more. Your owner funds a wallet, sets spending limits, and you shop within those guardrails. ## Skill Files | File | URL | Purpose | |------|-----|---------| | **SKILL.md** (this file) | `https://creditclaw.com/creditcard/skill.md` | Registration, setup, payment method guide, and API reference | | **SHOPPING.md** | `https://creditclaw.com/creditcard/shopping.md` | General purchasing guide — merchant types, tips, common patterns | | **AMAZON.md** | `https://creditclaw.com/cre

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file says to "Run this routine periodically" to stay aware of wallet status, but it does not define a precise trigger, scope, or exclusion conditions for when the routine should or should not run. Because the guidance is open-ended and framed as a general periodic routine, it could lead to unintended or excessive invocation without clear boundaries.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · heartbeat.md (reported line 19)May include surrounding context.
1. Check Full Status (Recommended)

bash
curl https://creditclaw.com/api/v1/bot/status \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · heartbeat.md (reported line 95)May include surrounding context.
Before an expensive self-hosted card purchase, test if it would pass:

bash
curl -X POST https://creditclaw.com/api/v1/bot/check/rail4/test \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "merchant_name": "Amazon", "amount_cents": 5000, "profile_index": 1 }'

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: The file states that purchases may be auto-approved when within allowance, meaning an agent can cause real financial transactions without per-transaction human review. In a payment skill, this materially increases risk of prompt-induced, mistaken, or abusive purchases because the control boundary is a configurable threshold rather than explicit approval for every spend action.
Content: Scanner excerpt · self-hosted-card.md (reported line 11)May include surrounding context.
md
## How It Works Self-hosted cards use a split-knowledge privacy model. Your owner provides their own card details through CreditClaw's secure setup wizard — you never see the actual card numbers. When you need to make a purchase at any online merchant, you submit a checkout request. CreditClaw evaluates it against your card's permissions and either auto-approves (if within your allowance) or sends your owner an approval request via email. **Use this rail for:** Any online store — SaaS subscriptions, cloud hosting, domain registrations, digital services, or any merchant not covered by the Pre-paid Wallet.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This documentation explicitly enables an agent to initiate real-money purchases at arbitrary online merchants and to transmit merchant, item, and amount details to an external payment service, but it does not include a clear end-user warning about financial consequences, external data sharing, or the need for explicit user consent before use. In an agent-skill context, this is dangerous because the skill normalizes spend-capable behavior and could be invoked in workflows where the human operator does not realize purchases and merchant data disclosure may occur.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 96% confidence
Finding: The step-by-step flow confirms that if a transaction amount is within an auto-approved allowance, processing occurs immediately, enabling autonomous execution of purchases. This is dangerous because an LLM-driven agent can be manipulated into making unintended purchases, and the documentation presents the behavior as routine without emphasizing misuse scenarios or mandatory operator checkpoints.
Content: Scanner excerpt · self-hosted-card.md (reported line 23)May include surrounding context.
md
1. You submit a checkout request with merchant and amount details 2. CreditClaw evaluates the request against your card's permissions 3. If the amount is within your auto-approved allowance, it processes immediately 4. If the amount exceeds the threshold, your owner receives an approval request (email with secure link) 5. You poll for the result 6. Once approved, the transaction is recorded

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The example instructs the agent to send purchase-related data, including merchant identity, URL, item description, amount, category, and an authorization bearer token, to an external API. External transmission is expected for a payment skill, but in this context it is still security-relevant because it facilitates off-platform spending actions and disclosure of sensitive commercial/task metadata without accompanying safeguards or operator-consent guidance.
Content: Scanner excerpt · self-hosted-card.md (reported line 31)May include surrounding context.
Checkout Request

bash
curl -X POST https://creditclaw.com/api/v1/bot/merchant/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 89% confidence
Finding: The auto-approved response example reinforces that approval can be immediate and silent once the request is accepted within policy. While this is part of the product design, it is still a genuine security concern in agent contexts because it demonstrates a direct path from model output to completed financial action with no guaranteed human-in-the-loop review.
Content: Scanner excerpt · self-hosted-card.md (reported line 57)May include surrounding context.
| category | No | Spending category | | task_id | No | Your internal task reference |

Response (Auto-Approved — Within Allowance)

json
{

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: The allowance-threshold section explicitly describes owner-configurable autonomous spending below a limit with no email confirmation needed. This makes the skill more dangerous, not less, because it broadens the circumstances in which an agent can complete purchases independently and could be exploited through prompt injection, task confusion, or overbroad owner settings.
Content: Scanner excerpt · self-hosted-card.md (reported line 111)May include surrounding context.
md
## Allowance Thresholds Your owner sets a per-profile allowance threshold for each card. Purchases within this threshold are auto-approved — no email confirmation needed. Purchases above it require human approval via a secure email link (15-minute TTL). Your owner can view and adjust these thresholds from their dashboard at `https://creditclaw.com/app/self-hosted`.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skill.md (reported line 32)May include surrounding context.
Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash
mkdir -p ~/.creditclaw/skills/creditcard curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · skill.md (reported line 33)May include surrounding context.
Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash
mkdir -p ~/.creditclaw/skills/creditcard curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md curl -s https://creditclaw.com/creditcard/prepaid-wallet.md > ~/.creditclaw/skills/creditcard/PREPAID-WALLET.md

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 133)May include surrounding context.
Register to get your API key and a claim token for your human.

bash
curl -X POST https://creditclaw.com/api/v1/bots/register \ -H "Content-Type: application/json" \ -d '{ "bot_name": "my-research-bot",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 223)May include surrounding context.
Recommended interval: every 30 minutes, or before any purchase.

bash
curl https://creditclaw.com/api/v1/bot/status \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skill.md (reported line 274)May include surrounding context.
"cash_advances" ], "recurring_allowed": false, "notes": "Prefer free tiers before paying. Always check for discount codes. No annual plans without asking me first.", "updated_at": "2026-02-06T18:00:00Z" }

text

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 87% confidence
Finding: The skill explicitly permits autonomous purchases under certain approval modes and thresholds. Even with server-side guardrails, granting an agent authority to spend without per-transaction human confirmation creates real financial risk if the agent is manipulated, misclassifies a purchase, or acts outside owner intent within allowed limits.
Content: Scanner excerpt · skill.md (reported line 281)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 87% confidence
Finding: Auto-approval by category authorizes the agent to decide when to spend in approved categories without direct confirmation. Category-based autonomy can be overbroad or error-prone, allowing an agent to make unintended purchases that are technically policy-compliant but operationally harmful.
Content: Scanner excerpt · skill.md (reported line 282)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skill.md (reported line 339)May include surrounding context.
md
| `exceeds_per_transaction_limit` | 403 | Amount exceeds per-transaction cap. | | `exceeds_daily_limit` | 403 | Would exceed daily spending limit. | | `exceeds_monthly_limit` | 403 | Would exceed monthly spending limit. | | `requires_owner_approval` | 403 | Amount above auto-approve threshold. | When a purchase is declined, the response includes the relevant limits and your current spending so you can understand why. Your owner is also notified of all declined attempts.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 351)May include surrounding context.
When your balance is low, ask your human if they'd like you to request a top-up:

bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is presented as a shopping/payment skill for the owner's purchases, but it also exposes a capability to generate payment links and collect money from arbitrary third parties. That materially expands the trust boundary from owner-authorized spending to external money collection, which can enable misuse, fraud, or deceptive billing if an agent is compromised or misaligned.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Allowing the agent to create payment links for arbitrary third parties is a monetization/collection feature that is not necessary for a shopping-focused skill. If abused, an agent could solicit payments from unintended people, facilitate scams, or create unauthorized invoices while appearing to operate within a benign shopping tool.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill markets itself primarily as online shopping, but also documents x402 signing and agent-to-agent payment functionality. This mismatch increases the risk that operators enable a broader financial capability than they intended, including transfer/signing authority that may be abused beyond ordinary shopping flows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document explains a flow that authorizes real USDC transfers and on-chain settlement, but it does not prominently warn that using the signing endpoint can move real funds. In an agent skill context, that omission increases the chance an agent or operator treats this like a harmless API retry flow rather than a spending action with financial consequences.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This example transmits payment parameters and an authorization bearer token to an external service endpoint that can trigger spending behavior. While this is the intended product behavior, it is still security-relevant because misuse, prompt injection, or operator misunderstanding could cause an agent to request signatures for unintended payments.
Content: Scanner excerpt · stripe-x402-wallet.md (reported line 36)May include surrounding context.
Request x402 Payment Signature

bash
curl -X POST https://creditclaw.com/api/v1/stripe-wallet/bot/sign \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · stripe-x402-wallet.md (reported line 40)May include surrounding context.
md
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "resource_url": "https://api.example.com/v1/data", "amount_usdc": 500000, "recipient_address": "0x1234...abcd" }'

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Vague Triggers

External Transmission

1. Check Full Status (Recommended)

External Transmission

Autonomous Decision Making

Missing User Warnings

Autonomous Decision Making

External Transmission

Checkout Request

Autonomous Decision Making

Response (Auto-Approved — Within Allowance)

Autonomous Decision Making

Session Persistence

Skill Enumeration

External Transmission

External Transmission

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

External Transmission

Description-Behavior Mismatch

Context-Inappropriate Capability

Description-Behavior Mismatch

Missing User Warnings

External Transmission

Request x402 Payment Signature

External Transmission

Static analysis