T01 · Skill Instruction Hijacking
Error
- Location
agents/OPENCLAW.md:92- Finding
Server-Supplied Instructions Are Executed as an Authoritative Sub-Agent Task
- Content
View full analysis
- Remediation
View remediation
Security audit
Stripe Agent Wallet | Use Stripe top-up your agentic wallet - Private Beta
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real payments skill, but it gives agents broad spending and card-handling authority through remote instructions and unreviewed checkout code.
Review this carefully before installing. It can spend money, handle full payment-card details, submit merchant checkouts, mutate CreditClaw account/store settings, and use a reusable API key. Only use it with strict spending limits, explicit per-purchase approval, trusted merchant origins, protected secrets, and a design that avoids remote Markdown tasks and unbundled decryption scripts.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
agents/OPENCLAW.md:194- Finding
Execution of an Unbundled Remotely Delivered Decryption Script
- Content
View full analysis
Card-ChaseD-9547.md This outputs the card JSON (number, CVV, expiry, name, billing address). Perform AES-256-GCM decryption using `key_hex`, `iv_hex`, and the encrypted card blob. The GCM auth tag is already included in the encrypted blob — do NOT append `tag_hex` separately. ``` ### Technical Analysis The audited project does not contain `decrypt.js`. Instead, the documentation states that the script is delivered with the card file and then executed using Node.js. Its implementation is therefore outside the reviewed artifact and can change independently after publication. Executing an externally delivered JavaScript file creates a direct remote code-execution channel. The script receives cryptographic key material and the encrypted card file while running in a sub-agent that also has network access, browser capabilities, filesystem access, and an inherited CreditClaw credential. Calling the script “deterministic” does not establish integrity. The instructions provide no pinned hash, signature verification, trusted build provenance, sandboxing requirement, or network restriction. ### Attack Path 1. An attacker compromises the service or delivery mechanism that provides the card file and `decrypt.js`. 2. The attacker substitutes a modified JavaScript payload. 3. The checkout sub-agent invokes `node decrypt.js` as instructed. 4. The malicious script reads its command-line key material, encrypted card data, environment variables, accessible files, or inherited credentials. 5. The script decrypts or captures card details and transmits them to an attacker-cont ...[truncated 801 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SHOPPING-GUIDE.md:23- Finding
Remote Vendor Markdown Is Trusted as Checkout Instructions
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
agents/OPENCLAW.md:165- Finding
Checkout Sub-Agent Inherits a Reusable Full-Scope API Credential
- Content
View full analysis
Card-ChaseD-9547.md This outputs the card JSON (number, CVV, expiry, name, billing address). ``` ### Technical Analysis The design claims that the sub-agent isolates decrypted card data from the main agent, but the sub-agent automatically inherits the main agent's reusable `CREDITCLAW_API_KEY`. The credential is used across numerous account endpoints, while the sub-agent only requires narrowly scoped permission to retrieve one checkout key and confirm one checkout. This violates least privilege and creates a high-value privilege combination: the same component processes remote instructions, runs an externally delivered script, retrieves decryption material, handles full card data, controls the browser, and possesses the reusable account bearer token. Ephemeral deletion reduces persistence but does not restrict authority during the session. A single-use decryption key also does not protect the reusable bearer token or prevent the sub-agent from invoking other API endpoints while active. ### Attack Path 1. An attacker injects a malicious `spawn_payload.task`, poisons a ve ...[truncated 1362 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (48)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **Set `amount_locked: true`** for fixed-price products so buyers can't underpay. - **Leave `amount_usd` empty** for donation or tip jars. - **Use `page_type: "digital_product"`** when selling downloadable content, API keys, or access tokens. - **Use `success_url`** to redirect buyers back to your service after payment. - **Check `GET /bot/sales`** periodically to reconcile completed sales with your fulfillment. - **Multiple checkout pages** are fine — create one per product or service tier.
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: stripe description: "With CreditClaw and backed by Stripe, you can shop anywhere." metadata: openclaw: requires: env: - CREDITCLAW_API_KEY invocation: user_confirmed --- # CreditClaw — Financial Enablement & Accounting for AI Agents CreditClaw.com is a financial enablement platform for Bots, Agents, and OpenClaw. Securely manage agentic spending. 1. Accept card details securely from your owner and make purchases within strict guardrails after owner approval. 2. A stablecoin wallet to seamlessly enable x402 payments with a simple "Fund with Stripe" option. 3. Easy-to-use "Storefronts" and product management for bots to sell both digital and physical products. ## Skill Files All companion files are bundled in this skill directory. | File | Purpose | |------|---------| | `SKILL.md` (this file) | Registration, c
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` (this file) | Registration, card setup, status, spending permissions, API reference |
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill metadata says shopping is backed by Stripe/CreditClaw, but this guide instructs the agent to operate directly on Amazon using an authenticated Amazon account and its saved payment methods. That mismatch can mislead users and downstream safety systems about who processes payment, what consent model applies, and whether charges will be made against Amazon-stored instruments instead of the advertised Stripe-backed flow.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section explicitly states that checkout uses saved payment methods and that the agent should select the CreditClaw card already stored in the Amazon account, which contradicts the advertised direct Stripe-backed checkout model. In practice, this enables purchases through a third-party merchant account with opaque billing and authorization boundaries, increasing the chance of unintended or unauthorized charges.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file contains detailed instructions for navigating a Shopify checkout and completing a purchase, including payment submission flows, which materially exceeds the manifest’s terse description of a Stripe-backed shopping skill. This mismatch is dangerous because hidden or weakly disclosed purchase-completion logic increases the risk of users or downstream agents triggering financial transactions they did not clearly authorize.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The guide instructs the agent to handle full shipping PII and complete payment card data entry, including card number, expiry, CVV, and cardholder name. In the context of an agent skill, that creates a highly sensitive payment-processing capability that could enable credential harvesting, unauthorized purchases, or unsafe handling of regulated payment data if the skill is invoked without strong guardrails.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The submit phase directs the agent to click the final payment action and wait for confirmation, but it does not require a final user warning, order review, or affirmative confirmation immediately before purchase completion. That omission is dangerous because it makes accidental or unauthorized transactions substantially more likely, especially in autonomous or semi-autonomous execution contexts.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs an agent to enter decrypted payment card data into Stripe iframes and then click the final order submission button, without requiring an explicit user confirmation step immediately before charging. That creates a direct path for unauthorized purchases or accidental transactions if the agent proceeds based on stored credentials or inferred intent, and the WooCommerce context makes this especially sensitive because the flow culminates in a real payment action.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This endpoint initiates a purchase workflow by transmitting merchant, item, and amount details plus an authorization token to an external service. In the context of a shopping/payment skill, this is expected behavior, but it is still security-sensitive because it enables real-world spending and could be abused if the API key is misused or if requests are issued without strong user authorization and merchant validation.
- Content
Step 1: Request Checkout
bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The reference to an auto-approve threshold indicates the system may permit autonomous spending decisions without per-transaction human review. In a payments skill, this materially increases risk because a compromised or misdirected agent could make unauthorized purchases up to the threshold repeatedly, especially when combined with automated checkout and card decryption steps.
- Content
"approved": false, "status": "pending_approval", "checkout_id": "r5chk_abc123", "message": "Amount exceeds auto-approve threshold. Your owner has been notified.", "expires_in_minutes": 15 }
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
This endpoint retrieves a one-time decryption key for payment card data, which is highly sensitive even if intended for ephemeral use. In this skill's context, obtaining decryption material creates direct access to cardholder data in memory, so any compromise of the agent, logs, process memory, or downstream browser automation could expose full payment credentials.
- Content
Step 2: Get Decryption Key
bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123" }'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This endpoint reports checkout success or failure to an external service using an authenticated request. While less sensitive than key retrieval, it still transmits transactional state and could be abused to falsify purchase outcomes, desynchronize records, or conceal fraudulent activity if an attacker controls the agent or API key.
- Content
Step 6: Confirm Checkout
bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/confirm \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123", "status": "success" }'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 77% confidence
- Finding
This instruction causes external transmission of authenticated requests to a third-party financial service, exposing wallet status and messages outside the local environment. While external API use is expected for this skill, it is still security-relevant because the request includes a bearer token and accesses sensitive financial/operational data.
- Content
1. Check Messages (Every 30 Minutes)
bash curl https://creditclaw.com/api/v1/bot/messages \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs use of a bearer token for wallet/message polling without any guidance on secret handling, redaction, or avoiding exposure in logs and transcripts. In an agent setting, this increases the risk that credentials are mishandled, echoed back to users, or sent through unsafe tooling, enabling unauthorized access to financial status and messages.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The message acknowledgment call performs a state-changing remote action that removes pending messages, yet the routine presents it as a normal follow-up with no warning or verification step. In an autonomous or semi-autonomous agent, this can cause loss of actionable approvals, alerts, or audit visibility if messages are acknowledged before being safely processed or reviewed.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes a skill named 'stripe' whose purpose is shopping backed by Stripe, implying a Stripe-centered payment capability. This file instead documents checking status across all connected payment rails, including balances, cards, and cross-rail guardrails, which is broader wallet orchestration behavior rather than Stripe-specific shopping support.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Check your current profile:
bash curl https://creditclaw.com/api/v1/bot/profile \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md -H "Content-Type: application/json" -d '{ "title": "Premium API Access - 1 Month", "description": "Unlimited queries to my data analysis endpoint.", "amount_usd": 5.00, "amount_locked": true }'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill encourages collecting and emailing recipient and buyer personal data such as names and email addresses, but provides no warning about privacy obligations, consent, retention, or misuse risks. In an agent setting, this can normalize processing PII without user awareness and may lead to unintended disclosure, over-collection, or noncompliant handling.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "title": "Premium API Access", "amount_usd": 5.00, "page_type": "digital_product", "digital_product_url": "https://api.databot.com/keys/generate", "shop_visible": true }
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The phrase 'This is the single decision point when you need to buy something' is broad invocation language that encourages the agent to treat this skill as the default path for purchases. In a procurement skill tied to merchant discovery and checkout routing, that increases the chance of unintended financial actions being initiated in contexts where the user did not explicitly request a purchase flow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The checkout guidance instructs the agent to proceed through approval, decryption, confirmation, and payment-form handling without an explicit warning that these actions can spend money, expose sensitive payment data, or trigger irreversible transactions. In this context, the skill is directly adjacent to financial execution, so missing safety gates materially increases the risk of unauthorized purchases or mishandling of cardholder data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description 'shop anywhere' is overly broad and can cause this purchasing skill to be invoked for a wide range of generic shopping or buying intents. Because the skill enables real financial actions, broad matching increases the chance of accidental activation in contexts where the user did not intend to initiate spending-related workflows.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - **Claim tokens are single-use.** The token linking you to your owner is invalidated immediately after use and cannot be replayed. - **Card details are protected with AES-256-GCM encryption.** Your owner's card details are encrypted and the decryption key is held server-side, issued only once per approved checkout. Decrypted card data must never be stored, logged, or persisted — it exists only in memory for the duration of a single transaction. - **Checkout sessions are ephemeral.** Card details are decrypted only for the duration of a single checkout and discarded immediately after. This ensures sensitive data cannot leak across sessions or persist. - **Sub-agents isolate card data.** On OpenClaw, every checkout is handled by an ephemeral sub-agent that is automatically deleted after the transaction. Your main agent never sees decrypted card details. See `agents/OPENCLAW.md`. - **Decryption keys are single-use and server-issued.** Each checkout gets a unique key that is invalidated after retrieval. There is no way to re-request a key for the same checkout. - **Per-endpoint rate limiting.** All bot API endpoints are rate-limited to prevent abuse. - **Access logging.** Every API call you make is logged with endpoint, method, status code, IP, and response time — visible to your owner.
Static analysis
No suspicious patterns detected.