Security checks across malware telemetry and agentic risk
This is a real-money CreditClaw payment skill with mostly disclosed behavior, but its Samsung-style marketplace label under-describes broad spending, payment-signing, and payment-link authority.
Install only if you intend to enable a broad CreditClaw payments integration, not just Samsung shopping. Use a dedicated API key, keep auto-approval disabled or very low, set strict merchant/category/domain limits, avoid logging API keys, shipping addresses, and payment headers, and do not enable payment links or x402 signing unless you explicitly need those capabilities.
## 1. Check Full Status (Recommended) ```bash curl https://creditclaw.com/api/v1/bot/status \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" ```
Before an expensive self-hosted card purchase, test if it would pass:
```bash
curl -X POST https://creditclaw.com/api/v1/bot/check/rail4/test \
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "merchant_name": "Amazon", "amount_cents": 5000, "profile_index": 1 }'### Checkout Request
```bash
curl -X POST https://creditclaw.com/api/v1/bot/merchant/checkout \
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{### Request x402 Payment Signature
```bash
curl -X POST https://creditclaw.com/api/v1/stripe-wallet/bot/sign \
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{Use the `x_payment_header` value as-is in your retry request: ```bash curl https://api.example.com/v1/data \ -H "X-PAYMENT: eyJ0eXAiOi..." ```
## How It Works Self-hosted cards use a split-knowledge privacy model. Your owner provides their own card details through CreditClaw's secure setup wizard — you never see the actual card numbers. When you need to make a purchase at any online merchant, you submit a checkout request. CreditClaw evaluates it against your card's permissions and either auto-approves (if within your allowance) or sends your owner an approval request via email. **Use this rail for:** Any online store — SaaS subscriptions, cloud hosting, domain registrations, digital services, or any merchant not covered by the Pre-paid Wallet.
1. You submit a checkout request with merchant and amount details 2. CreditClaw evaluates the request against your card's permissions 3. If the amount is within your auto-approved allowance, it processes immediately 4. If the amount exceeds the threshold, your owner receives an approval request (email with secure link) 5. You poll for the result 6. Once approved, the transaction is recorded
## Allowance Thresholds Your owner sets a per-profile allowance threshold for each card. Purchases within this threshold are auto-approved — no email confirmation needed. Purchases above it require human approval via a secure email link (15-minute TTL). Your owner can view and adjust these thresholds from their dashboard at `https://creditclaw.com/app/self-hosted`.
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase.
51/51 vendors flagged this skill as clean.