Security audit

Shop Car Insurance

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and openly about agent payments, but it grants broad real-money purchasing and payment-signing authority that users should review carefully before enabling.

Install only if you are comfortable giving an agent delegated spending authority. Keep the default ask-for-everything mode unless you have narrow merchant/category limits, low thresholds, strong monitoring, and an easy wallet freeze path. Treat CREDITCLAW_API_KEY like a financial credential and expect shipping, merchant, wallet, and transaction data to be sent to CreditClaw for fulfillment and approvals.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (31)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · skill.md (reported line 12)May include surrounding context.
md
rsion: 2.3.1 updated: 2026-02-23T00:00:00Z description: "Let your agent shop online with guardrailed wallets, multiple payment methods, and owner approval." homepage: https://creditclaw.com api_base: https://creditclaw.com/api/v1 credentials: [CREDITCLAW_API_KEY] metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}} --- # CreditClaw — Shopping for AI Agents CreditClaw lets your agent buy things online — Amazon products, Shopify stores, SaaS subscriptions, and more. Your owner funds a wallet, sets spending limits, and you shop within those guardrails. ## Skill Files | File | URL | Purpose | |------|-----|---------| | **SKILL.md** (this file) | `https://creditclaw.com/creditcard/skill.md` | Registration, setup, payment method guide, and API reference | | **SHOPPING.md** | `https://creditclaw.com/creditcard/shopping.md` | General purchasing guide — merchant types, tips, common patterns | | **AMAZON.md** | `https://creditclaw.com/cre

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · amazon.md (reported line 33)May include surrounding context.
Purchase Request

bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file tells the agent to call external CreditClaw endpoints using an API key and retrieve status across all connected payment rails, balances, limits, and guardrails. While the operational steps are clear, the description does not warn users that wallet/account data will be transmitted to a third-party service as part of the heartbeat routine.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · heartbeat.md (reported line 19)May include surrounding context.
1. Check Full Status (Recommended)

bash
curl https://creditclaw.com/api/v1/bot/status \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This workflow performs an authenticated POST that can trigger an account-side action, sending a top-up request automatically when balance is low. Even though it does not directly move funds, it can create financial prompts or operational side effects without an explicit opt-in or strong user-confirmation boundary in the skill itself, which is risky for a payment-related agent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · heartbeat.md (reported line 95)May include surrounding context.
Before an expensive self-hosted card purchase, test if it would pass:

bash
curl -X POST https://creditclaw.com/api/v1/bot/check/rail4/test \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "merchant_name": "Amazon", "amount_cents": 5000, "profile_index": 1 }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The purchase example instructs the agent to submit a full shipping address to CreditClaw so an order can be placed with an external merchant, but it does not clearly warn that personally identifiable information will be transmitted beyond the local system for fulfillment. In an agent context, this omission increases the chance that user data is sent without informed consent or appropriate privacy checks, especially because the flow normalizes routine use of address data.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This example performs an external POST request that includes sensitive data such as an API key and a shipping address. External transmission is expected for this product, but in a skill used by autonomous agents it is still security-relevant because it causes third-party disclosure of credentials and personal data and can trigger real-world purchases if invoked without sufficient user approval.
Content: Scanner excerpt · prepaid-wallet.md (reported line 43)May include surrounding context.
Purchase Request

bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · prepaid-wallet.md (reported line 98)May include surrounding context.
Step 1: Search for Variants

bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/search \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "product_url": "https://shop.example.com/products/widget" }'

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The documentation explicitly permits the agent to initiate purchases at any online merchant and describes an auto-approval path for transactions within allowance. Even though card numbers are hidden, the agent still gains delegated spending authority, which is dangerous if the agent is manipulated, misaligned, or given an overly broad task.
Content: Scanner excerpt · self-hosted-card.md (reported line 11)May include surrounding context.
md
## How It Works Self-hosted cards use a split-knowledge privacy model. Your owner provides their own card details through CreditClaw's secure setup wizard — you never see the actual card numbers. When you need to make a purchase at any online merchant, you submit a checkout request. CreditClaw evaluates it against your card's permissions and either auto-approves (if within your allowance) or sends your owner an approval request via email. **Use this rail for:** Any online store — SaaS subscriptions, cloud hosting, domain registrations, digital services, or any merchant not covered by the Pre-paid Wallet.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: This flow allows immediate processing when the amount falls under an auto-approved threshold, meaning the agent can independently trigger successful purchases without contemporaneous human review. In the context of an agent skill, that is a genuine autonomous financial action risk, not merely descriptive text, because it operationalizes a purchase workflow.
Content: Scanner excerpt · self-hosted-card.md (reported line 23)May include surrounding context.
md
1. You submit a checkout request with merchant and amount details 2. CreditClaw evaluates the request against your card's permissions 3. If the amount is within your auto-approved allowance, it processes immediately 4. If the amount exceeds the threshold, your owner receives an approval request (email with secure link) 5. You poll for the result 6. Once approved, the transaction is recorded

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The skill instructs an agent to send merchant, item, and amount details to an external payment API using an authorization bearer token. This enables real-world financial transactions and external data transmission; if invoked by an autonomous agent without strong runtime consent and scope checks, it can directly cause unauthorized purchases or spending abuse.
Content: Scanner excerpt · self-hosted-card.md (reported line 31)May include surrounding context.
Checkout Request

bash
curl -X POST https://creditclaw.com/api/v1/bot/merchant/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · self-hosted-card.md (reported line 57)May include surrounding context.
| category | No | Spending category | | task_id | No | Your internal task reference |

Response (Auto-Approved — Within Allowance)

json
{

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The allowance-threshold model explicitly states that purchases below a configured amount require no email confirmation, enabling unattended financial execution by the agent. In a payment skill whose purpose is to let an agent shop online, this materially increases danger because broad merchant coverage plus auto-approval lowers friction for misuse.
Content: Scanner excerpt · self-hosted-card.md (reported line 111)May include surrounding context.
md
## Allowance Thresholds Your owner sets a per-profile allowance threshold for each card. Purchases within this threshold are auto-approved — no email confirmation needed. Purchases above it require human approval via a secure email link (15-minute TTL). Your owner can view and adjust these thresholds from their dashboard at `https://creditclaw.com/app/self-hosted`.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · shopping.md (reported line 51)May include surrounding context.

Check wallet & spending permissions

Confirm purchase details with the user

Submit purchase/checkout request

Handle approval (auto-approved or pending owner approval)

Poll for result if pending

Report outcome to user (tracking info, confirmation, or error)

text

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skill.md (reported line 339)May include surrounding context.

Check wallet & spending permissions

Confirm purchase details with the user

Submit purchase/checkout request

Handle approval (auto-approved or pending owner approval)

Poll for result if pending

Report outcome to user (tracking info, confirmation, or error)

text

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skill.md (reported line 32)May include surrounding context.
Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash
mkdir -p ~/.creditclaw/skills/creditcard curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · skill.md (reported line 33)May include surrounding context.
Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash
mkdir -p ~/.creditclaw/skills/creditcard curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md curl -s https://creditclaw.com/creditcard/prepaid-wallet.md > ~/.creditclaw/skills/creditcard/PREPAID-WALLET.md

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: x402 signing and agent-to-agent payment support are unrelated to ordinary online shopping and introduce a stronger money-movement primitive than the skill name suggests. This mismatch can cause operators to over-grant authority, allowing an agent to authorize off-platform or on-chain payments under a misleading capability label.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 133)May include surrounding context.
Register to get your API key and a claim token for your human.

bash
curl -X POST https://creditclaw.com/api/v1/bots/register \ -H "Content-Type: application/json" \ -d '{ "bot_name": "my-research-bot",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 223)May include surrounding context.
Recommended interval: every 30 minutes, or before any purchase.

bash
curl https://creditclaw.com/api/v1/bot/status \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skill.md (reported line 274)May include surrounding context.
"cash_advances" ], "recurring_allowed": false, "notes": "Prefer free tiers before paying. Always check for discount codes. No annual plans without asking me first.", "updated_at": "2026-02-06T18:00:00Z" }

text

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The skill explicitly supports autonomous spending under certain approval modes, allowing the agent to make purchases without per-transaction human review. Even though guardrails are described, granting real purchasing autonomy to an agent is security-sensitive and can lead to financial loss if the agent is manipulated, mistaken, or operating on bad inputs.
Content: Scanner excerpt · skill.md (reported line 281)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: Category-based auto-approval lets an agent independently spend within broad classifications, which can be abused through misclassification, prompt injection, or deceptive merchant descriptions. Because this is tied to real money movement, errors in policy interpretation can directly convert into unauthorized spend.
Content: Scanner excerpt · skill.md (reported line 282)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 351)May include surrounding context.
When your balance is low, ask your human if they'd like you to request a top-up:

bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

External Transmission

Purchase Request

Missing User Warnings

External Transmission

1. Check Full Status (Recommended)

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

Purchase Request

External Transmission

Step 1: Search for Variants

Autonomous Decision Making

Autonomous Decision Making

External Transmission

Checkout Request

Autonomous Decision Making

Response (Auto-Approved — Within Allowance)

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Session Persistence

Skill Enumeration

Context-Inappropriate Capability

External Transmission

External Transmission

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

External Transmission

Static analysis