Shop from Apple - With your creditcard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:41 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed shopping/payment integration, but it also gives agents high-impact money movement authority, including an under-disclosed ability to create payment links to charge third parties.

Install only if you intentionally want an agent to make real purchases and possibly create payment links. Keep `CREDITCLAW_API_KEY` in a secure secret store, enable the strictest approval mode, set low per-transaction/daily/monthly limits, disable or tightly restrict payment-link creation if you do not need receivables, and ensure any shipping addresses or payer emails are shared with clear user consent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

rsion: 2.3.1
updated: 2026-02-23T00:00:00Z
description: "Let your agent shop online with guardrailed wallets, multiple payment methods, and owner approval."
homepage: https://creditclaw.com
api_base: https://creditclaw.com/api/v1
credentials: [CREDITCLAW_API_KEY]
metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}}
---

# CreditClaw — Shopping for AI Agents

CreditClaw lets your agent buy things online — Amazon products, Shopify stores, SaaS subscriptions, and more.
Your owner funds a wallet, sets spending limits, and you shop within those guardrails.

## Skill Files

| File | URL | Purpose |
|------|-----|---------|
| **SKILL.md** (this file) | `https://creditclaw.com/creditcard/skill.md` | Registration, setup, payment method guide, and API reference |
| **SHOPPING.md** | `https://creditclaw.com/creditcard/shopping.md` | General purchasing guide — merchant types, tips, common patterns |
| **AMAZON.md** | `https://creditclaw.com/cre

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

External Transmission

Medium

• Category: Data Exfiltration

Content

### Purchase Request

```bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This markdown file includes executable curl examples that transmit an Authorization bearer token from the sensitive environment variable `CREDITCLAW_API_KEY`. While the examples show how to authenticate, the document does not warn users that these commands use a credential or advise safe handling of that secret, which is a missing user-facing warning under the markdown criteria.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 1. Check Full Status (Recommended)

```bash
curl https://creditclaw.com/api/v1/bot/status \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This routine directs the agent to send a state-changing top-up request automatically when balance is low, which can trigger external workflow effects and notify or pressure the owner without explicit approval at execution time. In a purchasing/payment skill, automatic financial-action requests are more sensitive because they can generate unintended spend-related operations or social-engineering style nudges on a recurring heartbeat.

External Transmission

Medium

• Category: Data Exfiltration

Content

Before an expensive self-hosted card purchase, test if it would pass:

```bash
curl -X POST https://creditclaw.com/api/v1/bot/check/rail4/test \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "merchant_name": "Amazon", "amount_cents": 5000, "profile_index": 1 }'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The purchase example instructs users to send a full shipping address, product details, and an API credential to a third-party purchasing service, but it does not explicitly warn that personal data will be transmitted onward to CreditClaw and likely merchants/logistics providers. In a payment and shopping context, omission of a privacy/data-sharing warning can mislead integrators into handling sensitive personal data without adequate notice, consent, or minimization controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Purchase Request

```bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 84% confidence
• Finding: This example performs an external API call that transmits sensitive information, including an authorization bearer token and a recipient shipping address, to a remote service. External transmission is expected for the feature, but in this context it is still security-relevant because the documentation normalizes sending secrets and PII without nearby cautions about secure handling, redaction, or consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 1: Search for Variants

```bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/search \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "product_url": "https://shop.example.com/products/widget" }'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## How It Works

Self-hosted cards use a split-knowledge privacy model. Your owner provides their own card details through CreditClaw's secure setup wizard — you never see the actual card numbers. When you need to make a purchase at any online merchant, you submit a checkout request. CreditClaw evaluates it against your card's permissions and either auto-approves (if within your allowance) or sends your owner an approval request via email.

**Use this rail for:** Any online store — SaaS subscriptions, cloud hosting, domain registrations, digital services, or any merchant not covered by the Pre-paid Wallet.

• Confidence: 88% confidence
• Finding: The documentation describes a system where purchases may be auto-approved within an allowance, allowing an agent to trigger real-world financial transactions without per-transaction human review. In a payment skill, autonomous action is materially risky because the agent may act on manipulated inputs, misunderstand user intent, or repeatedly spend within the threshold.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. You submit a checkout request with merchant and amount details
2. CreditClaw evaluates the request against your card's permissions
3. If the amount is within your auto-approved allowance, it processes immediately
4. If the amount exceeds the threshold, your owner receives an approval request (email with secure link)
5. You poll for the result
6. Once approved, the transaction is recorded

• Confidence: 90% confidence
• Finding: This flow states that if an amount is within the auto-approved allowance, processing happens immediately, which gives the agent authority to commit funds without a human in the loop. The surrounding context makes this more dangerous, not less, because the rail is intended for broad online merchant use, increasing the chance of misuse across many services.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Checkout Request

```bash
curl -X POST https://creditclaw.com/api/v1/bot/merchant/checkout \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: The skill explicitly instructs an agent to transmit merchant, purchase, and authorization data to an external payment API to complete transactions. Even though this is the advertised purpose of the skill, it enables real-money spending at arbitrary online merchants, so any prompt injection, task confusion, or misuse by the agent could lead to unauthorized purchases or financial loss.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `category` | No | Spending category |
| `task_id` | No | Your internal task reference |

### Response (Auto-Approved — Within Allowance)

```json
{

• Confidence: 86% confidence
• Finding: The auto-approved response format confirms that the system is designed to complete transactions automatically when policy thresholds are met. While not malicious by itself, this operationalizes autonomous spending and may encourage downstream agent implementations to treat approval as routine rather than exceptional, increasing the chance of unauthorized or unintended purchases.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Allowance Thresholds

Your owner sets a per-profile allowance threshold for each card. Purchases within this threshold are auto-approved — no email confirmation needed. Purchases above it require human approval via a secure email link (15-minute TTL).

Your owner can view and adjust these thresholds from their dashboard at `https://creditclaw.com/app/self-hosted`.

• Confidence: 89% confidence
• Finding: Allowance thresholds that permit no-confirmation purchases create a standing permission for autonomous spending. In this skill's context—shopping at essentially any online store—that materially expands the blast radius of prompt injection, compromised agent logic, or accidental repeated purchases.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Check wallet & spending permissions
2. Confirm purchase details with the user
3. Submit purchase/checkout request
4. Handle approval (auto-approved or pending owner approval)
5. Poll for result if pending
6. Report outcome to user (tracking info, confirmation, or error)
```

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Check wallet & spending permissions
2. Confirm purchase details with the user
3. Submit purchase/checkout request
4. Handle approval (auto-approved or pending owner approval)
5. Poll for result if pending
6. Report outcome to user (tracking info, confirmation, or error)
```

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:
```bash
mkdir -p ~/.creditclaw/skills/creditcard
curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md
curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md
curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:
```bash
mkdir -p ~/.creditclaw/skills/creditcard
curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md
curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md
curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md
curl -s https://creditclaw.com/creditcard/prepaid-wallet.md > ~/.creditclaw/skills/creditcard/PREPAID-WALLET.md

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Transmission

Medium

• Category: Data Exfiltration

Content

Register to get your API key and a claim token for your human.

```bash
curl -X POST https://creditclaw.com/api/v1/bots/register \
  -H "Content-Type: application/json" \
  -d '{
    "bot_name": "my-research-bot",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Recommended interval: every 30 minutes, or before any purchase.

```bash
curl https://creditclaw.com/api/v1/bot/status \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"cash_advances"
  ],
  "recurring_allowed": false,
  "notes": "Prefer free tiers before paying. Always check for discount codes. No annual plans without asking me first.",
  "updated_at": "2026-02-06T18:00:00Z"
}
```

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.

• Confidence: 86% confidence
• Finding: The skill explicitly supports autonomous spending under configured thresholds, allowing the agent to spend without real-time owner approval. While this is an intended feature, it is still a genuine risk surface because prompt injection, task confusion, or compromised agent behavior could trigger valid-but-undesired purchases within those limits.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.
- Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

• Confidence: 86% confidence
• Finding: Category-based auto-approval permits autonomous purchases in preapproved categories, which still creates financial risk if the agent is manipulated into making unnecessary or adversarially induced purchases that technically fit the category. The context lowers risk somewhat because server-side guardrails exist, but those guardrails do not prevent misuse within allowed bounds.

External Transmission

Medium

• Category: Data Exfiltration

Content

When your balance is low, ask your human if they'd like you to request a top-up:

```bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as an owner-approved shopping/payment tool, but it also exposes a capability to generate Stripe payment links for arbitrary third parties. That materially expands the trust boundary from spending the owner's funds to operating as a payment-collection surface, which could be abused for unauthorized billing, spam invoicing, or social-engineering workflows not implied by the manifest.

Static analysis

No suspicious patterns detected.