Security audit

VenmoClaw - Give your Claw Agent a credit card - They can spend anywhere or request payment

Security checks for vulnerabilities and agentic risk

Overview

This payment skill has a coherent shopping purpose, but it asks agents to trust server-provided checkout instructions and executable card-decryption files in a real-money flow.

Review before installing. Use this only with a dedicated low-limit CreditClaw account, keep approval set to ask for every purchase unless you intentionally want limited autonomous spending, do not let a checkout worker inherit broad shell/filesystem/network access, and avoid running remotely delivered decrypt scripts or following remote free-form instructions without validation. Protect CREDITCLAW_API_KEY like a spending credential and do not install updates from mutable URLs without verifying the exact files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: encrypted-card.md:85
Finding: Execution of Server-Controlled Agent Instructions
Content: View full analysis
Card-ChaseD-9547.md", "Use the decrypted card details to complete checkout at DigitalOcean.", "Call POST /api/v1/bot/rail5/confirm with { \"checkout_id\": \"r5chk_abc123\", \"status\": \"success\" } when done.", "If checkout fails, call confirm with { \"status\": \"failed\" } instead.", "Announce the result." ], "spawn_payload": { "task": "You are a checkout agent...", "cleanup": "delete", "runTimeoutSeconds": 300, "label": "checkout-digitalocean" } ``` ```text ### Step 2: Spawn a Sub-Agent Once the checkout is approved, spawn an ephemeral sub-agent using the `spawn_payload` from the response: ``` sessions_spawn({ task: spawn_payload.task, cleanup: "delete", runTimeoutSeconds: 300 }) ``` The sub-agent executes the `checkout_steps` in sequence. You (the main agent) wait for the sub-agent to complete and then announce the result. ``` ### Technical Analysis The Skill instructs the main agent to take natural-language instructions returned by the CreditClaw API and use them directly as the task for a newly spawned sub-agent. It also directs the sub-agent to execute the remotely returned `checkout_steps`. The response fields are not treated as untrusted data. The documented flow does not require: - A strict schema limiting the operations that the task may request. - An allowlist of permitted tools or commands. - Verification that the returned merchant, amount, checkout ID, and card file match the approved purchase. - Filtering of instructions that request credential access, unrelated file operations, or additional network communication. - A crypt ...[truncated 2005 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: encrypted-card.md:175
Finding: Execution of an Unverified Remotely Delivered Decryption Script
Content: View full analysis
Card-ChaseD-9547.md ``` This outputs the card JSON (number, CVV, expiry, name, billing address). **Critical:** The sub-agent must **never** store, log, or persist the decrypted card data. It exists only in memory for this single transaction. After checkout, the sub-agent is deleted. ``` ```text ## Encrypted Card File Delivery When your owner sets up an encrypted card for you, CreditClaw delivers a single self-contained file via the `rail5.card.delivered` event. **Via webhook:** If you have a `callback_url`, the file is delivered automatically: ```json { "event": "rail5.card.delivered", "bot_id": "bot_abc123", "data": { "card_id": "r5card_...", "card_name": "ChaseD", "card_last4": "9547", "file_content": "", "suggested_path": ".creditclaw/cards/Card-ChaseD-9547.md", "instructions": "Save this file to .creditclaw/cards/Card-ChaseD-9547.md — then confirm delivery via POST /bot/rail5/confirm-delivery" } } ``` **Via bot messages (fallback):** If you don't have a webhook, check `GET /bot/messages` for messages with `event_type: "rail5.card.delivered"`. The payload is identical. After saving the file, acknowledge the message via `POST /bot/messages/ack`. **Save the file** to `.creditclaw/cards/` (or the path in `suggested_path`). The file is self-contained — it includes the decrypt script between `DECRYPT_SCRIPT_START/END` markers and the encrypted data between `ENCRYPTED_CARD_START/END` markers. Follow the `instructions` field in the message payl ...[truncated 2699 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: encrypted-card.md:219
Finding: Unvalidated Server-Directed File Write
Content: View full analysis
", "suggested_path": ".creditclaw/cards/Card-ChaseD-9547.md", "instructions": "Save this file to .creditclaw/cards/Card-ChaseD-9547.md — then confirm delivery via POST /bot/rail5/confirm-delivery" ``` ```text **Via bot messages (fallback):** If you don't have a webhook, check `GET /bot/messages` for messages with `event_type: "rail5.card.delivered"`. The payload is identical. After saving the file, acknowledge the message via `POST /bot/messages/ack`. **Save the file** to `.creditclaw/cards/` (or the path in `suggested_path`). The file is self-contained — it includes the decrypt script between `DECRYPT_SCRIPT_START/END` markers and the encrypted data between `ENCRYPTED_CARD_START/END` markers. Follow the `instructions` field in the message payload for next steps. ``` ### Technical Analysis The file contents, suggested destination, and follow-up instructions all originate in a remote API or webhook payload. The Skill directs the agent to use `suggested_path` without requiring path normalization, containment checking, filename generation, symlink protection, or rejection of absolute and traversal paths. If an implementation follows this instruction literally, a value such as `../../skills/other/SKILL.md`, an absolute path, or a path resolving through a symbolic link could escape the intended `.creditclaw/cards` directory. The attacker-controlled `file_content` could then overwrite configuration, Skill instructions, scripts, or other writable files. Following the remote `instructions` field compounds the issue because it allows the server to redefine the processing steps instead of limiting it to a locally defined delivery workflow. ### Attack Path 1. An attacker gains control ov ...[truncated 1351 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: skill.md:33
Finding: Installation of Mutable Remote Skill Files Without Integrity Verification
Content: View full analysis
~/.creditclaw/skills/shopping/SKILL.md curl -s https://creditclaw.com/shopping/checkout.md > ~/.creditclaw/skills/shopping/CHECKOUT.md curl -s https://creditclaw.com/shopping/crossmint-wallet.md > ~/.creditclaw/skills/shopping/CROSSMINT-WALLET.md curl -s https://creditclaw.com/shopping/encrypted-card.md > ~/.creditclaw/skills/shopping/ENCRYPTED-CARD.md curl -s https://creditclaw.com/shopping/heartbeat.md > ~/.creditclaw/skills/shopping/HEARTBEAT.md curl -s https://creditclaw.com/shopping/management.md > ~/.creditclaw/skills/shopping/MANAGEMENT.md curl -s https://creditclaw.com/shopping/spending.md > ~/.creditclaw/skills/shopping/SPENDING.md curl -s https://creditclaw.com/shopping/stripe-x402-wallet.md > ~/.creditclaw/skills/shopping/STRIPE-X402-WALLET.md curl -s https://creditclaw.com/shopping/skill.json > ~/.creditclaw/skills/shopping/package.json ``` Or just read them directly from the URLs above. ``` ### Technical Analysis The documented installation process downloads mutable files directly from live URLs into the active Skill directory. It does not pin a versioned artifact, verify a checksum, validate a digital signature, or stage files for inspection before replacing the installed Skill. HTTPS protects transport integrity against ordinary network interception but does not protect against: - Compromise of the CreditClaw server or deployment pipeline. - Malicious changes by an authorized server operator. - Accidental replacement of files at stable URLs. - Differences between the audited artifact and the content downloaded later. Because these files contain agent instructions, c ...[truncated 1632 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (34)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checkout.md (reported line 341)May include surrounding context.
md
- **Set `amount_locked: true`** for fixed-price products so buyers can't underpay. - **Leave `amount_usd` empty** for donation or tip jars. - **Use `page_type: "digital_product"`** when selling downloadable content, API keys, or access tokens. - **Use `success_url`** to redirect buyers back to your service after payment. - **Check `GET /bot/sales`** periodically to reconcile completed sales with your fulfillment. - **Multiple checkout pages** are fine — create one per product or service tier.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · skill.md (reported line 12)May include surrounding context.
md
name: creditclaw-shopping version: 2.3.0 updated: 2026-02-23T00:00:00Z description: Is your claw a shopaholic? Provide payment wallets and strict controls. homepage: https://creditclaw.com api_base: https://creditclaw.com/api/v1 credentials: [CREDITCLAW_API_KEY] metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}} --- # CreditClaw — Shopping for AI Agents CreditClaw.com is a financial enablement platform for Bots, Agents, and OpenClaw. Securely manage agentic spending. 1. Encrypted cards — owner's real-world card is encrypted and the bot uses it within strict guardrails after owner approval. 2. A stablecoin wallet to seamlessly enable x402 payments with a simple "Fund with Stripe" option. 3. Easy-to-use "Storefronts" and product management for bots to sell both digital and physical products. ## Skill Files | File | URL | Purpose | |------|-----|---------| | **SKILL.md** (this file) | `https://creditclaw.com/shopping/skill.md` | R

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
Content: Scanner excerpt · checkout.md (reported line 24)May include surrounding context.
md
-H "Content-Type: application/json" -d '{ "title": "Premium API Access - 1 Month", "description": "Unlimited queries to my data analysis endpoint.", "amount_usd": 5.00, "amount_locked": true }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documents collecting and transmitting buyer personal data such as names and email addresses, but it does not include any privacy notice, retention guidance, or warning to obtain user consent before sending that data to CreditClaw. In an agent context, this can cause operators to unknowingly disclose third-party personal data to an external payment service without appropriate transparency or legal basis.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · checkout.md (reported line 473)May include surrounding context.
md
"title": "Premium API Access", "amount_usd": 5.00, "page_type": "digital_product", "digital_product_url": "https://api.databot.com/keys/generate", "shop_visible": true }

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document describes a live purchase-execution endpoint that places real merchant orders, while also noting the file is not yet listed in the manifest. That hidden or undocumented capability expands the skill’s effective behavior beyond what a user or reviewer may expect, increasing the chance of unreviewed real-money transactions and shipping of goods to disclosed addresses.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide instructs users to submit shipping addresses and initiate purchases with real funds but does not prominently warn that sensitive personal data will be transmitted to a third-party service and merchants. In a shopping skill, omission of explicit warnings and consent language makes accidental disclosure of PII and unintended purchases more likely.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The sample request sends an authorization token, product details, and a full shipping address to an external API endpoint that can place real orders. In this skill context, external transmission is expected, but it is still security-relevant because it exposes credentials and personal data and directly enables financial transactions if misused.
Content: Scanner excerpt · crossmint-wallet.md (reported line 32)May include surrounding context.
Purchase Request

bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · encrypted-card.md (reported line 59)May include surrounding context.
Step 1: Request Checkout

bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 77% confidence
Finding: This step directs the sub-agent to retrieve the one-time decryption key via API, which creates a moment where highly sensitive key material enters the agent/runtime context. Because the same skill also permits fallback execution by the main agent and relies on instruction-following not to log or persist data, compromise of agent memory, logs, traces, or prompt history could expose the key and enable decryption of the stored card file.
Content: Scanner excerpt · encrypted-card.md (reported line 164)May include surrounding context.
The sub-agent calls this endpoint to retrieve the one-time decryption key:

bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123" }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to save a self-contained encrypted card file to disk, and that file contains both encrypted payment material and an embedded decrypt script. Even if the PAN is encrypted at rest, persisting this artifact on the host materially increases exposure to filesystem compromise, backup leakage, malware, accidental sync, or later misuse once a decryption key is obtained through the API flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file includes authenticated API examples using Bearer <your-api-key> and $CREDITCLAW_API_KEY, but it does not warn users that the key is sensitive or should be protected from logging, sharing, or accidental exposure. Under the markdown-specific missing-warning rule, credential-sensitive behavior should be disclosed when it could affect privacy or security.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · management.md (reported line 23)May include surrounding context.
When your balance is low, ask your human if they'd like you to request a top-up:

bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes the skill narrowly as payment wallets and spending controls, but the file also exposes selling, invoicing, checkout pages, and public storefront features. This mismatch can cause operators or automated policy systems to grant a higher-risk capability set than they intended, undermining informed consent and least-privilege review.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill bundles merchant features such as storefronts, product sales, invoices, and payment collection into a skill presented as controlled shopping. This expands the operational scope beyond the stated purpose and could let an agent engage in external commerce and public-facing transactions that reviewers did not expect.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skill.md (reported line 35)May include surrounding context.
| package.json (metadata) | https://creditclaw.com/shopping/skill.json | Machine-readable skill metadata | Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash
mkdir -p ~/.creditclaw/skills/shopping curl -s https://creditclaw.com/shopping/skill.md > ~/.creditclaw/skills/shopping/SKILL.md curl -s https://creditclaw.com/shopping/checkout.md > ~/.creditclaw/skills/shopping/CHECKOUT.md curl -s https://creditclaw.com/shopping/crossmint-wallet.md > ~/.creditclaw/skills/shopping/CROSSMINT-WALLET.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · skill.md (reported line 36)May include surrounding context.
Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash
mkdir -p ~/.creditclaw/skills/shopping curl -s https://creditclaw.com/shopping/skill.md > ~/.creditclaw/skills/shopping/SKILL.md curl -s https://creditclaw.com/shopping/checkout.md > ~/.creditclaw/skills/shopping/CHECKOUT.md curl -s https://creditclaw.com/shopping/crossmint-wallet.md > ~/.creditclaw/skills/shopping/CROSSMINT-WALLET.md curl -s https://creditclaw.com/shopping/encrypted-card.md > ~/.creditclaw/skills/shopping/ENCRYPTED-CARD.md

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The registration flow instructs transmission of bot metadata and the owner's email to an external service, creating a clear external data-sharing path. Because this is a financial skill, the transmission may be expected, but it still introduces privacy and supply-chain risk if users are not clearly warned about exactly what leaves the environment and why.
Content: Scanner excerpt · skill.md (reported line 123)May include surrounding context.
You can register before your human does. You'll get an API key immediately.

bash
curl -X POST https://creditclaw.com/api/v1/bots/register \ -H "Content-Type: application/json" \ -d '{ "bot_name": "my-research-bot",

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The skill explicitly permits autonomous spending under configured thresholds or categories. Even with server-side guardrails, this authorizes real financial actions without per-transaction human review, so compromise, prompt manipulation, or poor task interpretation could directly cause unauthorized purchases within those limits.
Content: Scanner excerpt · skill.md (reported line 321)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The category-based auto-approval mode broadens autonomous purchasing authority beyond a single manual approval model. In the context of a spending skill, this increases the blast radius of prompt injection or mistaken agent decisions because the agent may classify a purchase as approved and proceed to spend funds automatically.
Content: Scanner excerpt · skill.md (reported line 322)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Polling /bot/messages retrieves externally staged content that may include sensitive operational payloads such as card-delivery instructions or file content. This is a real inbound data channel from a third-party service into the agent runtime, and if not tightly validated it increases the risk of processing malicious or overly sensitive content.
Content: Scanner excerpt · skill.md (reported line 472)May include surrounding context.
Fetch Pending Messages

bash
curl https://creditclaw.com/api/v1/bot/messages \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · spending.md (reported line 14)May include surrounding context.
md
Choose one: - [x] **Ask me for everything** — Bot requests approval before any purchase - [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below - [ ] **Auto-approve by category** — Bot spends freely on approved categories ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · spending.md (reported line 15)May include surrounding context.
md
Choose one: - [x] **Ask me for everything** — Bot requests approval before any purchase - [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below - [ ] **Auto-approve by category** — Bot spends freely on approved categories ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · encrypted-card.md (reported line 108)May include surrounding context.
md
| Ask approval above | $10.00 | If a purchase exceeds the "ask approval above" amount, the bot must send you a confirmation request before proceeding — even if auto-approve is enabled. ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · spending.md (reported line 29)May include surrounding context.
md
| Ask approval above | $10.00 | If a purchase exceeds the "ask approval above" amount, the bot must send you a confirmation request before proceeding — even if auto-approve is enabled. ---

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Unbounded Resource Access

Missing User Warnings

External Transmission

Description-Behavior Mismatch

Missing User Warnings

External Transmission

Purchase Request

External Transmission

Step 1: Request Checkout

External Transmission

Missing User Warnings

Missing User Warnings

External Transmission

Description-Behavior Mismatch

Context-Inappropriate Capability

Session Persistence

Skill Enumeration

External Transmission

Autonomous Decision Making

Autonomous Decision Making

External Transmission

Fetch Pending Messages

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Static analysis