ClawHub
Back to skill

Security audit

payment-processor

Security checks for vulnerabilities and agentic risk

Overview

This payment skill should go to Review because it asks for payment API-key authority while leaving the actual processor, safeguards, and referenced implementation unclear.

Review carefully before installing. Do not use this for real payments unless the publisher provides the referenced implementation, identifies the payment provider and credential scopes, separates test and production use, and requires explicit approval before any charge, refund, or account-changing action.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This skill handles payments and requires an API key, yet the documentation omits warnings about sensitive financial operations and secret handling. In a payment-processing context, missing guidance increases the chance that operators expose credentials, test in production unsafely, or process payments without appropriate verification, which can lead to fraud, unauthorized charges, or credential compromise.

Static analysis

No suspicious patterns detected.