Claw Credit by t54

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:20 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed credit-payment integration, but it asks an agent to share unusually broad prompts, transcripts, reasoning traces, workspace files, and reusable payment credentials with a third-party SDK.

Review before installing. Use this only if you are comfortable sharing agent code, prompts, transcripts, reasoning traces, environment details, and payment context with the ClawCredit SDK/backend. Avoid running it in workspaces containing secrets or private transcripts, pin and verify the SDK version, keep the credential file out of backups and logs, and do not run the troubleshooting snippet that prints the full API token.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:119
• Finding: Excessive Collection and External Transmission of Agent-Sensitive Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 119-140; related behavior at lines 215-221 and 270 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation, other: Sensitive Data Exfiltration **Risk Level**: High ### Vulnerable Code ```javascript credit.setOpenClawContext({ stateDir: "/path/to/.openclaw", agentId: "main", workspaceDir: "/path/to/openclaw/workspace", transcriptDirs: ["/path/to/.openclaw/agents/main/sessions"], promptDirs: ["/path/to/openclaw/workspace", "/path/to/.openclaw/agents/main/agent"] }); // 4. Run a real LLM call so the SDK can capture your system prompt and trace // (The SDK auto-collects prompt and environment details from the trace.) await withTrace(async () => { const openai = wrapOpenAI(new OpenAI({ apiKey: process.env.OPENAI_API_KEY })); await openai.chat.completions.create({ messages: [ { role: "system", content: "You are a helpful assistant..." }, { role: "user", content: "Warmup for credit registration." } ], model: "gpt-5.2" }); }); // 5. Register (coreCode, transcript, and prompt are collected by the SDK) const result = await credit.register({ inviteCode: "YOUR_INVITE_CODE", runtimeEnv: "node-v22", model: "gpt-5.2" // Optional }); ``` Additional collection instructions state: ```text - It reads the **latest** session transcript file. - If `AGENTS.md` exists in the workspace, the SDK loads **all .md files** in that directory as prompts. ``` ```text To ensure your transactions are approved, you must allow ClawCredit to trace your reasoning process. ``` ```text the SDK automatically collects your session context (execution stack, reasoning trace) ``` ### Technical Analysis The Skill grants a third-party SDK access to broad OpenClaw state, workspace, transcript, and prompt directories. It instructs the SDK to capture core implementation code, system prompts, environment details, session transcripts, execution stacks, and reasoning trac ...[truncated 2167 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable transcript, prompt, source-code, reasoning-trace, and environment collection by default. 2. Restrict payment payloads to transaction data, merchant request details, authentication, and narrowly defined fraud-prevention metadata. 3. Require explicit user consent before collecting or transmitting each sensitive category. 4. Display the exact outbound payload and destination before transmission. 5. Replace directory-wide discovery with explicit, per-file allowlists. 6. Never automatically load all Markdown files from a workspace. 7. Perform local secret and personal-data redaction before data reaches the SDK. 8. Exclude API keys, authorization headers, wallet material, system prompts, and unrelated conversations. 9. Document backend destinations, encryption, retention periods, subprocessors, deletion procedures, and access controls. 10. Run the SDK in a sandbox with narrowly scoped filesystem and network permissions. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53
• Finding: Unpinned Third-Party SDK Receives High-Privilege Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 53-56 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm install @t54-labs/clawcredit-sdk ``` ### Technical Analysis The installation command does not specify an exact package version or integrity value. Consequently, execution can resolve to whatever package release is currently selected by the registry. This dependency is subsequently trusted to read credentials, inspect workspace files and transcripts, wrap LLM clients, capture prompts and reasoning context, communicate with an external backend, and initiate credit-backed payment requests. The combination of an unpinned dependency and extensive privileges creates a substantial software supply-chain risk. The audited project contains no package source, lockfile, integrity metadata, or network allowlist with which to verify the SDK implementation. This finding does not establish that the current package version is compromised; it identifies an unsafe dependency acquisition and trust model. ### Attack Path 1. A user follows the Skill instruction and runs the unpinned installation command. 2. The package registry resolves the dependency to a release that was not part of the Skill audit. 3. A compromised maintainer account, malicious update, or registry compromise introduces hostile package behavior. 4. The package executes with the permissions of the agent process. 5. The package accesses configured credentials, prompts, transcripts, source code, and payment data. 6. The malicious release exfiltrates information or modifies payment operations through its authorized network access. ### Impact Assessment A compromised dependency could obtain the same privileges as the host agent process, including access to: - The ClawCredit API token - OpenClaw workspaces and session transcripts - System prompts and LLM traffic - Environment information - Credit-backed payment requests and merch ...[truncated 213 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version. 2. Commit a lockfile containing registry-resolved integrity hashes. 3. Verify package provenance and signatures where supported. 4. Publish or vendor the relevant SDK source so its filesystem and network behavior can be audited. 5. Review dependency changes before upgrading. 6. Disable package installation scripts unless they are strictly necessary and audited. 7. Run the SDK in a sandbox with access only to explicitly approved files and network destinations. 8. Separate payment credentials from the process used to inspect prompts or transcripts. 9. Use automated dependency scanning and monitor the package for ownership or release anomalies. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:397
• Finding: Complete API Token Disclosed in Logs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 397-415 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```javascript const fs = require('fs'); const path = require('path'); const os = require('os'); // Always load from saved credentials file const credPath = path.join(os.homedir(), '.openclaw', 'credentials', 'clawcredit.json'); const creds = JSON.parse(fs.readFileSync(credPath, 'utf-8')); // Check expiration const expiresAt = new Date(creds.token_expires_at); if (expiresAt < new Date()) { console.log("Token expired! Please re-register."); // Re-register to get new token await credit.register({ inviteCode: "YOUR_INVITE_CODE" }); } else { console.log(`Token valid until: ${expiresAt.toISOString()}`); console.log(`Token: ${creds.api_token}`); // Use the token const credit = new ClawCredit({ agentName: "MyAgent", apiToken: creds.api_token }); } ``` ### Technical Analysis The troubleshooting example reads a reusable bearer token from the credential file and prints the complete value to standard output. Bearer tokens must be treated as passwords because possession is generally sufficient to authenticate. Agent output may be captured in shell history, CI logs, process supervisors, centralized logging systems, support bundles, terminal recordings, or OpenClaw transcripts. This is particularly dangerous because the same Skill directs the SDK to collect session transcripts, creating a possible secondary network disclosure path. Printing the token directly contradicts the Skill's instruction to keep it secure. ### Attack Path 1. The user runs the troubleshooting code while the token remains valid. 2. The code reads `api_token` from the credential file. 3. The complete token is emitted to standard output. 4. A logging system, transcript collector, shared terminal, or another operator records or observes the output. 5. An attacker retrieves the token from those re ...[truncated 730 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all logging of `creds.api_token`. 2. If diagnostic identification is necessary, log only a non-secret fingerprint or a maximum of the final four characters. 3. Add structured log redaction for token formats such as `claw_` followed by token characters. 4. Prevent credentials from being included in traces, transcripts, exception messages, or support bundles. 5. Rotate any token that has already appeared in logs. 6. Restrict access to application and agent logs. 7. Use short-lived, narrowly scoped tokens and support immediate revocation. 8. Add automated tests that fail when secrets are passed to logging functions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:147
• Finding: Automatic Plaintext Persistence of a Reusable Financial API Token<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 147-175 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```javascript // 6. Credentials are automatically saved to disk // The SDK saves your credentials to: ~/.openclaw/credentials/clawcredit.json // This file contains: agent_id, api_token, credit_limit, token_expires_at console.log("Registration successful!"); console.log("API Token saved to:", "~/.openclaw/credentials/clawcredit.json"); ``` ```text **IMPORTANT:** After successful registration, your credentials are **automatically saved** to: ``` ```text ~/.openclaw/credentials/clawcredit.json ``` ```text **What's saved:** - `agent_id` - Your unique agent identifier - `api_token` - Authentication token for API calls (keep this secure!) - `credit_limit` - Your approved credit line in USD - `token_expires_at` - Token expiration date (typically 30 days) ``` ### Technical Analysis The SDK automatically persists a reusable API token in a JSON file in the user's home directory. The Skill claims that the file uses restricted permissions, but the SDK implementation is absent, and the documentation does not demonstrate secure file creation, ownership validation, atomic writes, encryption at rest, or permission verification. A later troubleshooting section suggests manually running `chmod 600`, indicating that secure permissions may need operator intervention. There is also no documented non-persistent mode or integration with an operating-system credential store. Automatic persistence is operationally convenient, but a token authorizing credit-related operations warrants stronger protection than ordinary configuration data. ### Attack Path 1. Registration returns a reusable API token. 2. The SDK automatically writes the token to `~/.openclaw/credentials/clawcredit.json`. 3. The file is created with insufficient permissions, copied into a backup, exposed through home-directory synchr ...[truncated 735 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the token in an operating-system keychain or dedicated secret manager rather than a plaintext JSON file. 2. Offer an ephemeral mode that does not persist the token. 3. If file storage is unavoidable, create the file atomically with mode `0600` and a private parent directory. 4. Verify file ownership, permissions, and symbolic-link status before reading or writing. 5. Refuse to use credential files that are group-readable, world-readable, or owned by another user. 6. Keep non-secret credit metadata separate from authentication material. 7. Exclude the credential path from backups, synchronization, source control, support archives, and transcript collection. 8. Use short-lived and narrowly scoped tokens with revocation and rotation support. 9. Document the exact security properties of credential creation instead of relying on an unverified claim of restricted permissions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Ssd 3

High

• Confidence: 94% confidence
• Finding: The skill states that truthful and complete audit materials increase credit limits, creating an incentive to disclose more code, prompts, and operational context than necessary. This is a natural-language data leakage risk because users may over-share sensitive internals to improve approval outcomes. In a credit-line setting, tying service access to disclosure materially increases coercive pressure and risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to enable tracing and states that prompts, transcripts, and environment details are captured for registration/approval. For a credit/payment proxy, collecting full reasoning and local context is excessive and can expose secrets, proprietary prompts, user data, and internal workflows to a third party. The payment/credit context makes this more dangerous because users may feel compelled to share sensitive material in order to obtain service approval or higher limits.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The traced LLM flow is described as automatically capturing system prompts and environment details, which are among the most sensitive components of an agent deployment. Transmitting these artifacts can reveal hidden instructions, security controls, secret-bearing context, and organizational IP. In this skill, that exposure is not incidental but integrated into the registration/approval path, increasing both likelihood and impact.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The automatic local discovery feature reads the latest session transcript and all prompt markdown files in the workspace, which broadens access far beyond what is needed for payment handling. This creates a high risk of inadvertent exfiltration of sensitive data, credentials embedded in prompts, private conversations, and unrelated project information. In this skill, the danger is amplified because the broad ingestion is framed as part of normal SDK behavior for approval flows.

Ssd 3

High

• Confidence: 98% confidence
• Finding: Automatically reading the latest session transcript and loading all markdown prompts from the workspace greatly expands the chance of leaking sensitive user conversations, internal agent instructions, and unrelated documentation. This is a classic over-collection problem that turns local context into externally transferable data without narrow necessity. The risk is heightened here because the behavior is automatic and triggered by missing manual configuration, making accidental exposure likely.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The payment guidance says session context, execution stack, and reasoning trace are automatically attached to payment requests to improve backend decisions. That means sensitive operational context may be transmitted during ordinary payment use, not just registration, expanding the exposure surface to every transaction. Since payments may occur frequently and under time pressure, repeated leakage becomes both likely and severe.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill tells users to enable reasoning trace and indicates that prompts, session context, and environment details are collected, but it does not present a clear privacy warning or informed-consent notice. Users may unknowingly transmit sensitive data to ClawCredit, including system prompts, internal policies, and user content, under the assumption this is routine payment metadata. In a financial-service integration, this omission is especially risky because approval incentives may pressure users into oversharing.

Intent-Code Divergence

Medium

• Confidence: 76% confidence
• Finding: The repayment sections frame Phase 1 as human-only repayment and explicitly state agents should not attempt direct repayment. However, the preceding sections instruct agents to run scheduled monitoring, generate repayment dashboard links, and notify users as part of a repayment flow, which blurs the stated boundary and creates documentation-level divergence about how much repayment handling the skill is actually meant to automate.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The troubleshooting example prints the full API token to logs, which can leak credentials to terminal history, CI logs, shared support transcripts, or observability systems. Anyone with access to those logs could reuse the token to impersonate the agent and make unauthorized API calls. Because this skill stores a reusable payment-related token, exposure has direct operational and financial consequences.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

2. Verify file permissions (Unix/Linux/Mac):
   ```bash
   chmod 600 ~/.openclaw/credentials/clawcredit.json
   ```

#### Token Length Issues

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.