Book a flight or Airbnb | Is your claw a nomad?

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This is a real-money agent wallet and commerce skill whose core behavior is disclosed, but its financial authority is broad enough that users should review it carefully before installing.

Install only if you intend to delegate real spending or payment collection to this agent. Keep approval mode set to ask for every purchase unless you have tight limits, use a dedicated low-balance wallet/card, store the API key and webhook secret in a secrets manager, review any payment-link/shop features separately, and treat delivered card files or bot-message payloads as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The document describes a real Crossmint-based purchasing flow and explicitly notes it is 'not yet listed in the skill manifest,' which means the skill exposes or documents material transactional capability beyond the declared Stripe wallet scope. Hidden or undocumented purchasing features are dangerous because users and reviewers may not understand that the agent can place real merchant orders using held funds and third-party infrastructure.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest description frames the skill as a wallet for top-ups and purchases, but the file also exposes seller/merchant capabilities such as payment links, invoices, checkout pages, and a public shop. This scope mismatch can mislead operators and policy engines into granting a broader financial capability than they intended, increasing the chance of unauthorized payment collection or misuse.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The skill includes storefront and sales functions that are not necessary for the stated wallet-use purpose, creating hidden capability expansion. In an agent ecosystem, undeclared commercial actions can bypass user expectations and increase financial, compliance, and fraud risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents collecting and transmitting buyer personal data such as recipient names, recipient emails, and buyer_email values, but provides no user-facing privacy notice, consent guidance, retention guidance, or handling limitations. In a payment and invoicing context, this creates privacy and compliance risk because agents may process PII by default without informing users or constraining downstream use.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The purchase guide instructs agents to submit shipping addresses, product details, and authorization credentials to an external API without an explicit warning that this triggers real purchases and transmits sensitive personal and financial-affecting data. In an agent skill context, omission of these warnings increases the chance of unintended orders, privacy exposure, and misuse of owner funds because an autonomous system may treat the operation as routine.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to save a self-contained encrypted card file containing payment material and a decrypt script to local disk. Even if encrypted, persisting card artifacts locally increases the attack surface through filesystem compromise, backups, logging, sync tools, or later unsafe handling, and the file path is predictable.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly describes a payment-signing flow that results in real USDC transfers and on-chain settlement, but it does not prominently warn that using these endpoints can spend real funds. In an agent context, missing transactional-risk warnings increases the chance of unintended autonomous purchases or retries that trigger financial loss.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The examples use a live bearer API key in curl commands without warning about credential handling, which can lead to secrets being exposed through shell history, logs, screenshots, shared terminals, or copied commands. In a wallet/payment skill, API key exposure could let an attacker query balances, inspect transactions, or request payment signatures within configured guardrails.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Fetch Pending Messages

```bash
curl https://creditclaw.com/api/v1/bot/messages \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY"
```

• Confidence: 78% confidence
• Finding: curl https://creditclaw.com/api/v1/bot/messages \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" ``` Response: ```json { "bot_id": "bot_abc123", "messages": [ { "id": 1, "event_

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.

• Confidence: 83% confidence
• Finding: auto_approve

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.
- Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

• Confidence: 83% confidence
• Finding: auto_approve

VirusTotal

57/57 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.