Security audit
Security checks for vulnerabilities and agentic risk
This payment skill needs review because it gives agents real spending authority and card-handling workflows that are broader and less clearly bounded than the package metadata suggests.
Install only after careful review by someone authorized to manage payment risk. Confirm that spending modes, approval thresholds, card handling, Crossmint ordering, x402 signing, invoice emails, buyer/shipping data, and remote instruction updates are acceptable for the bot using this skill. Prefer per-transaction human approval and avoid entering real card details into provider-hosted pages unless the provider can prove a compliant tokenized flow.
encrypted-card.md:73Server-Supplied Instructions Can Hijack Agent Actions
encrypted-card.md:208Card Activation Workflow Sends Full Cardholder Data to a CreditClaw-Hosted Test Page
skill.json:15Unpinned Remote Skill Documents Can Change After Package Review
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- **Set `amount_locked: true`** for fixed-price products so buyers can't underpay.
- **Leave `amount_usd` empty** for donation or tip jars.
- **Use `page_type: "digital_product"`** when selling downloadable content, API keys, or access tokens.
- **Use `success_url`** to redirect buyers back to your service after payment.
- **Check `GET /bot/sales`** periodically to reconcile completed sales with your fulfillment.
- **Multiple checkout pages** are fine — create one per product or service tier.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
description: "VISA Virtual Cards | Manage compatible cards, wallets & payments. Financial management for Agents and OpenClaw bots."
homepage: https://creditclaw.com
api_base: https://creditclaw.com/api/v1
credentials: [CREDITCLAW_API_KEY]
metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}}
---
# CreditClaw — Financial Enablement & Accounting for AI Agents
CreditClaw.com is a financial enablement platform for Agents and OpenClaw.
Securely manage agentic spending.
1. Accept card details securely from your owner and make purchases within strict guardrails after owner approval.
2. A stablecoin wallet to seamlessly enable x402 payments with a simple "Fund with Stripe" option.
3. Easy-to-use "Storefronts" and product management for bots to sell both digital and physical products.
## Skill Files
| File | URL | Purpose |
|------|-----|---------|
| **SKILL.md** (this file) | `https://creditclaw.com/skill.md` | Registration, setup, webhooks,
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
-H "Content-Type: application/json"
-d '{
"title": "Premium API Access - 1 Month",
"description": "Unlimited queries to my data analysis endpoint.",
"amount_usd": 5.00,
"amount_locked": true
}'
The skill documents collect_buyer_name as a buyer-data collection feature, but provides no warning about handling personal information or the privacy impact of collecting names. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect user data or privacy.
The file instructs users to provide recipient_name and recipient_email, and later states the invoice is sent via email with a PDF attachment. This is a user-data/privacy-affecting behavior in markdown, but the skill text does not warn that customer data will be transmitted to the service and used for outbound email delivery.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"title": "Premium API Access",
"amount_usd": 5.00,
"page_type": "digital_product",
"digital_product_url": "https://api.databot.com/keys/generate",
"shop_visible": true
}
The file documents wallet-based purchasing through Crossmint, which expands beyond the declared VISA virtual card scope and introduces additional payment and order-placement behavior. Scope drift in a financial skill is dangerous because agents or reviewers may rely on the manifest boundary while the hidden or auxiliary documentation enables real-world purchases through a separate mechanism.
The document explicitly states it is not listed in the skill manifest while still exposing an active purchase endpoint for real orders. Hidden or unmanifested transactional functionality is especially risky in an agent skill because it can bypass expected review, policy gating, or user awareness while still enabling financial actions.
The instructions describe submitting purchase requests with shipping address details but do not clearly warn that this places real orders and sends personal data to external services. In a financial/commerce context, that omission increases the risk of unintended purchases, privacy violations, and misuse by downstream agents that may treat the example as a harmless simulation.
The example shows an authenticated POST request that transmits purchase details and personal shipping information to an external API, which then routes orders to third parties. External transmission is expected for this feature, but in this context it is still security-relevant because it enables real financial actions and disclosure of sensitive personal data.
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://creditclaw.com/api/v1/bot/rail5/checkout \
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The documented flow allows immediate approval within preset thresholds, enabling purchases without transaction-specific human review. In a payment skill, autonomous spending authority increases the risk of prompt-injection-driven purchases, merchant spoofing, abuse of allowed categories, or rapid low-value fraud that stays under approval limits.
"approved": false, "status": "pending_approval", "checkout_id": "r5chk_abc123", "message": "Amount exceeds auto-approve threshold. Your owner has been notified.", "expires_in_minutes": 15 }
This endpoint returns the one-time decryption key used to recover full card details, meaning the skill enables the agent to obtain sensitive payment credentials in usable form. In the context of an autonomous bot, that is highly sensitive capability: if the bot, runtime, logs, or dependent tools are compromised, an attacker could turn encrypted stored card data into plaintext card details for fraudulent use.
Once the checkout is approved, call this endpoint to retrieve the one-time decryption key:
curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "checkout_id": "r5chk_abc123" }'
The file extends beyond transient checkout use and instructs the agent to receive and retain encrypted card data for later decryption and use. Even though the data is encrypted at rest, distributing card material to the agent and telling it to store/manage it expands the attack surface substantially: compromise of the bot, webhook, message queue, or secrets storage could expose reusable encrypted PAN data and enable later misuse once keys are obtained.
The heartbeat routine claims to be for a VISA virtual cards skill, but it instructs the agent to query a broad 'all connected payment rails' status endpoint and process balances, limits, and guardrails across multiple rails. This scope mismatch can cause over-collection of sensitive financial data and grant the skill visibility beyond what a user would reasonably expect from a VISA-focused capability.
The skill directs authenticated calls that reveal balances, spending limits, connected rails, and master guardrails, but it does not clearly warn users that sensitive financial account metadata will be accessed on a recurring basis. In the context of an agent skill handling payments, silent background retrieval of this data increases privacy risk and may exceed user expectations or consent boundaries.
The documentation explicitly includes Stripe Wallet and x402 rail operations, which materially exceed a VISA virtual cards description. In a financial skill, this kind of hidden or under-declared expansion increases the risk of unauthorized payment actions, broader token use, and user misunderstanding about which payment systems the agent can inspect or operate.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
When your balance is low, ask your human if they'd like you to request a top-up:
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The manifest explicitly advertises "spending power" and financial management for agents, but provides no warning, consent model, guardrails, or indication of transaction limits/review requirements. In an agent ecosystem, this is dangerous because it encourages autonomous financial actions against a live API using only an API key, increasing the risk of unauthorized purchases, card misuse, or unintended payments.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
You can register before your human does. You'll get an API key immediately.
curl -X POST https://creditclaw.com/api/v1/bots/register \
-H "Content-Type: application/json" \
-d '{
"bot_name": "my-research-bot",
The skill explicitly authorizes autonomous purchases under certain server-side policy modes, which enables an agent to spend funds without real-time human confirmation. Although guardrails and thresholds reduce abuse, a compromised or prompt-influenced agent could still make undesired but policy-compliant purchases, creating financial loss and accountability risk.
**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.
Category-based auto-approval permits the agent to independently decide whether a purchase fits an approved category and proceed without immediate owner review. Misclassification, prompt manipulation, or overly broad categories can let the agent initiate unintended transactions while still remaining within server-enforced limits.
**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.
- Cache this for up to 30 minutes. Do not fetch before every micro-purchase.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl https://creditclaw.com/api/v1/bot/messages \
-H "Authorization: Bearer $CREDITCLAW_API_KEY"
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Choose one:
- [x] **Ask me for everything** — Bot requests approval before any purchase
- [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below
- [ ] **Auto-approve by category** — Bot spends freely on approved categories
---
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Choose one:
- [x] **Ask me for everything** — Bot requests approval before any purchase
- [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below
- [ ] **Auto-approve by category** — Bot spends freely on approved categories
---
No suspicious patterns detected.