Security audit

Claw Credit by t54

Security checks across malware telemetry and agentic risk

Overview

The skill fits its credit-payment purpose, but it asks agents to share sensitive prompts, traces, transcripts, and code while enabling credit-backed payments with unclear limits.

Review before installing. Only use this skill if you are comfortable sharing agent code, prompts, transcripts, traces, and environment/session context with ClawCredit, and if you understand the repayment obligation. Pin and audit the SDK version, restrict transcript and prompt paths, require explicit approval for each paid call, set spending limits and merchant allowlists, review request bodies before forwarding them, and never print or share the saved API token.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The registration flow instructs the agent to transmit core code, prompts, transcripts, and trace/environment details to a third-party credit service even though those materials can contain secrets, system prompts, internal policies, user data, or proprietary logic. For a payment proxy, this is excessive data collection and creates a real confidentiality risk if sensitive local context is uploaded during underwriting.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: Automatic discovery that loads the latest transcript and all markdown prompt files from the workspace can sweep up unrelated sensitive data without user review. This broad collection materially increases the chance of exfiltrating credentials, internal instructions, customer data, or proprietary prompts to the ClawCredit backend.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The payment flow says transactions automatically include session context, execution stack, and reasoning traces to improve approvals. Tying sensitive runtime context to each merchant payment creates unnecessary exposure during routine transactions and can leak internal decision logic, user content, and secrets beyond what is needed to settle payment.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill explicitly tells agents to enable tracing of their reasoning process for underwriting approval. Capturing and forwarding chain-of-thought-style reasoning is sensitive because it may embed secrets, policy text, hidden prompts, or user data, and it is not necessary for normal payment processing.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The documentation claims credentials are securely stored, yet the example later encourages printing the API token to console output. Logging a live authentication token can expose it through terminal history, CI logs, telemetry collectors, or shared debugging sessions, enabling account misuse.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill describes automatic collection of prompts, transcripts, and environment details but does not provide a clear user-facing warning about the privacy implications. This omission makes accidental oversharing more likely because operators may not realize sensitive local context is being uploaded during registration.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Recommending automatic loading of all markdown files and the latest transcript without a safety warning increases the likelihood of unintended inclusion of sensitive materials. In an agent workspace, markdown often contains system prompts, notes, credentials, or operational instructions that should not be indiscriminately shared.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The payment flow forwards the original HTTP request body to the merchant endpoint without warning users to review sensitive content first. If the body contains personal data, API keys, or internal business context, the skill may facilitate unintended disclosure to third parties during payment-backed requests.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The troubleshooting example prints the full API token while failing to warn against secret exposure in logs. This is dangerous because console output is frequently captured in shell history, CI/CD logs, observability pipelines, or shared support artifacts, making token compromise likely.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.