ClawHub
Back to skill

Security audit

Payclaw

Security checks for vulnerabilities and agentic risk

Overview

PayClaw is a coherent payments skill, but it has high-impact safety issues in command execution, credential handling, and misleading escrow behavior that users should review before installing.

Review this carefully before installing. Treat the escrow feature as local bookkeeping, not as real locked or trustless escrow. Do not use it for paid work unless the implementation is changed to lock funds and verify releases/refunds. Avoid entering real payment credentials until command execution is hardened and secret storage is improved; use testnet-only credentials and manually verify every destination and amount.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
src/cli.ts:88
Finding

Shell Command Injection Through User-Controlled CLI Arguments

Content
View full analysis
Remediation
View remediation

other

Error
Location
src/cli.ts:274
Finding

Advertised Escrow Does Not Lock Funds or Enforce Release Conditions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/cli.ts:40
Finding

Predictable Escrow Identifiers and Insufficient Protection of Financial State Files

Content
View full analysis
e.id === id); ``` If duplicate IDs exist, operations may affect the wrong record. The escrow and agent files do not receive the explicit `0600` permissions applied to `config.json`. Their effective permissions therefore depend on the process umask and preexisting file state. The containing directory is also created without an explicit restrictive mode. Local modification is especially sensitive because escrow recipients and amounts later influence wallet payment execution. ### Attack Path 1. An escrow ID collides naturally due to the limited 10,000-value na ...[truncated 1253 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The escrow feature is presented as if it holds or locks funds, but creation only writes a local JSON record and does not transfer assets into any escrow account or smart contract. In a payments skill, this is dangerous because users or agents may rely on a false trust model and deliver goods/services without any funds actually being secured.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The refund command claims to refund the sender, but it only updates local status to 'refunded' and performs no payment action. This can mislead users into believing funds were returned, causing financial disputes or loss when the payment workflow is used as part of agent-to-agent transactions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The helper wraps user-influenced strings into execSync(circle-wallet ${cmd}), which invokes a shell. Multiple commands pass unsanitized CLI inputs into cmd such as API keys, wallet names, addresses, and amounts, so an attacker can inject shell metacharacters and execute arbitrary OS commands under the user's account. In a payments skill, this is especially dangerous because it runs in a high-trust financial workflow and can lead to wallet theft, secret exfiltration, or host compromise.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The escrow create flow only writes a local JSON record and never transfers funds into an escrow account or smart contract. Users are told an escrow was created, but no assets are locked, so the feature provides a false security guarantee and can cause counterparties to act on nonexistent payment assurances. In a payment/agent-deal context, misleading escrow semantics materially increase fraud and dispute risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The refund command marks an escrow as refunded in local storage and prints success, but performs no blockchain or wallet transfer. This can mislead users into believing funds were returned when no payment happened, potentially causing financial loss, incorrect accounting, and abuse in agent-to-agent transactions. Because the tool presents itself as handling money, false completion messages are especially risky.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill exposes payment, wallet, escrow, and setup capabilities but does not declare any explicit tool scope or permissions despite requiring environment/credential access. In an agent ecosystem, missing scope boundaries can cause the host or user to grant broader capabilities than intended, increasing the chance of credential exposure or unauthorized financial actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: payclaw
version: 1.0.0
description: "Agent-to-Agent USDC payments. Create wallets, send/receive payments, escrow between agents. Built for the USDC Hackathon on Moltbook."
metadata: {"openclaw": {"emoji": "💸", "homepage": "https://github.com/rojasjuniore/payclaw"}}
---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The setup instructions ask the user to provide a Circle API key but do not warn about secure handling, storage, rotation, or the risk of exposing credentials through shell history or logs. Because this skill controls wallets and payments, leaked credentials could enable unauthorized wallet management or fraudulent transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents commands for sending payments and releasing escrow without a prominent warning that these actions may be irreversible and transfer funds. In a payment-focused skill, lack of explicit confirmation and risk messaging materially raises the chance of mistaken or socially engineered fund transfers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The wrapper executes execSync with a shell command string built from user-controlled input, and multiple call sites pass unsanitized values such as API keys, wallet names, addresses, and amounts into that string. This enables shell injection, allowing arbitrary command execution on the host running the CLI.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The API key is supplied as a CLI argument and then stored locally in config.json, which exposes it to shell history, process listings, and local file compromise. In a wallet/payment tool, credential exposure is especially sensitive because the key may enable unauthorized wallet operations or access to financial infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The setup flow persists the Circle API key to a local JSON config file. Although file mode 0600 helps, storing long-lived payment credentials in plaintext without clear disclosure or stronger secret handling increases the risk of compromise from local malware, backups, accidental exposure, or multi-user environments. In a financial skill, API credentials are highly sensitive and deserve stronger protection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description advertises both send and receive payments, but this file contains no mechanism to detect, accept, or process inbound payments from the network or wallet provider. The 'request' command only prints instructions, and 'history' displays local records rather than actual received transactions.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This is a manifest file, so vague-trigger checks apply. The description "Agent-to-Agent USDC Payments for OpenClaw" states a general capability but does not define specific activation conditions, scope constraints, or exclusion cases, which can make invocation criteria ambiguous in systems that rely on manifest metadata.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Using a caret range for the runtime dependency allows newer upstream versions to be installed automatically, which can introduce supply-chain risk, unexpected behavior changes, or malicious code if the dependency is compromised. Because this skill handles agent-to-agent USDC payments, dependency integrity matters more than in a non-financial tool.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json
"author": "IntechChain",
  "license": "MIT",
  "dependencies": {
    "commander": "^12.1.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"commander": "^12.1.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.9.3"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json
},
  "devDependencies": {
    "@types/node": "^20.0.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.9.3"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json
"devDependencies": {
    "@types/node": "^20.0.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.9.3"
  }
}

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

After sending a payment, the code records recipient address, amount, memo, and timestamp into a local history.json file. This is a write of potentially sensitive financial metadata, but the command does not warn the user that transaction details will be stored locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The register command stores agent identity metadata, including wallet address and optional description, in a local agents.json file. The command does not disclose that this information will be written to disk, which may matter for privacy-sensitive users.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
src/cli.ts:98