Security audit

bitrefill

Security checks for vulnerabilities and agentic risk

Overview

This Bitrefill skill is not clearly malicious, but it needs review because it can spend real money and includes risky credential and recurring-purchase guidance.

Install only with a dedicated low-balance Bitrefill account. Prefer OAuth or bearer-token headers, do not place API keys in MCP URLs, keep buy-products out of auto-approve settings, and avoid recurring cron purchases unless they have explicit caps, expiration, recipient/SKU locks, and a way to list and cancel them.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: references/mcp.md:8
Finding: Purchase-Capable API Key Embedded in MCP URL
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: references/host-openclaw.md:91
Finding: Persistent Unattended Purchases Bypass the Skill's Transaction Approval Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/cli.md:57
Finding: OpenClaw Bootstrap Stores a Purchase Credential Without a Documented Permission Guarantee
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (59)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cli.md (reported line 29)May include surrounding context.
md
1. **`--api-key <key>`** — global flag; can appear before any subcommand. 2. **`BITREFILL_API_KEY`** — environment variable. 3. **`~/.config/bitrefill-cli/credentials.json`** — written by `bitrefill init` (mode `0600`). Overwrite or remove to change the key. 4. **OAuth** — only when no key is available **and** the session is interactive (TTY, not `CI=true`). Browser flow; state under `~/.config/bitrefill-cli/<host>.json` (e.g. `api.bitrefill.com.json`). Clear with `bitrefill logout` (OAuth only; no-op when using API key only). Generate keys at <https://www.bitrefill.com/account/developers>.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/troubleshooting.md (reported line 92)May include surrounding context.
md
1. **`--api-key <key>`** — global flag; can appear before any subcommand. 2. **`BITREFILL_API_KEY`** — environment variable. 3. **`~/.config/bitrefill-cli/credentials.json`** — written by `bitrefill init` (mode `0600`). Overwrite or remove to change the key. 4. **OAuth** — only when no key is available **and** the session is interactive (TTY, not `CI=true`). Browser flow; state under `~/.config/bitrefill-cli/<host>.json` (e.g. `api.bitrefill.com.json`). Clear with `bitrefill logout` (OAuth only; no-op when using API key only). Generate keys at <https://www.bitrefill.com/account/developers>.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/troubleshooting.md (reported line 100)May include surrounding context.
md
1. **`--api-key <key>`** — global flag; can appear before any subcommand. 2. **`BITREFILL_API_KEY`** — environment variable. 3. **`~/.config/bitrefill-cli/credentials.json`** — written by `bitrefill init` (mode `0600`). Overwrite or remove to change the key. 4. **OAuth** — only when no key is available **and** the session is interactive (TTY, not `CI=true`). Browser flow; state under `~/.config/bitrefill-cli/<host>.json` (e.g. `api.bitrefill.com.json`). Clear with `bitrefill logout` (OAuth only; no-op when using API key only). Generate keys at <https://www.bitrefill.com/account/developers>.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/mcp.md (reported line 88)May include surrounding context.
OAuth: codex mcp login bitrefill.

Gemini CLI — ~/.gemini/settings.json (or project .gemini/settings.json)

json
{

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/mcp.md (reported line 78)May include surrounding context.
codex --sandbox workspace-write --ask-for-approval on-request

text
Put `BITREFILL_API_KEY` in a profile (`~/.codex/config.toml` `[profiles.bitrefill]`), not in committed config. ### Claude Code

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/safeguards.md (reported line 62)May include surrounding context.
codex --sandbox workspace-write --ask-for-approval on-request

text
Put `BITREFILL_API_KEY` in a profile (`~/.codex/config.toml` `[profiles.bitrefill]`), not in committed config. ### Claude Code

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/safeguards.md (reported line 66)May include surrounding context.
Claude Code

In ~/.claude/settings.json (or project .claude/settings.json):

json
{

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/safeguards.md (reported line 72)May include surrounding context.
md
{ "sandbox": { "filesystem": { "denyRead": ["~/.ssh", ".env", "*.pem", "**/.bitrefill_token"], "denyWrite": ["~/.ssh", ".env"] }, "network": {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/safeguards.md (reported line 73)May include surrounding context.
md
{ "sandbox": { "filesystem": { "denyRead": ["~/.ssh", ".env", "*.pem", "**/.bitrefill_token"], "denyWrite": ["~/.ssh", ".env"] }, "network": {

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is broad enough to activate on generic payment- or crypto-related requests that may not actually be about Bitrefill. Over-broad activation can route unrelated user intents into a real-money purchase skill, increasing the chance of unintended transaction flows or unnecessary credential handling.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
- **Use a dedicated, low-balance account.** Never give the agent access to high-balance accounts or crypto wallet seeds. This skill is **not a wallet**. - **Log every purchase.** `invoice_id`, product, amount, payment method. Full safeguards + per-host hardening (OpenClaw exec-approvals, Cursor auto-approve, Codex sandbox, Claude Code allowlist) → [safeguards.md](references/safeguards.md). ## References

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 5)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 24)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 28)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 31)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 34)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 43)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 46)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 60)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/host-openclaw.md (reported line 44)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/host-openclaw.md (reported line 54)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/mcp.md (reported line 9)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/mcp.md (reported line 35)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/mcp.md (reported line 53)May include surrounding context.
md
Use when: outbound HTTP available but no MCP and no shell. Last resort — verbose, no typed validation. Examples below use `curl` but any HTTP client works. Base URL: `https://api.bitrefill.com/v2` ## Three tiers

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T06 · System Persistence

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Credential Access

Credential Access

Agent Config Directory Access

Gemini CLI — ~/.gemini/settings.json (or project .gemini/settings.json)

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Claude Code

Credential Access

Credential Access

Vague Triggers

Autonomous Decision Making

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis

Gemini CLI — `~/.gemini/settings.json` (or project `.gemini/settings.json`)