Security audit
Security checks across malware telemetry and agentic risk
This is a coherent CreditClaw shopping and payments skill, but it gives an agent real spending and payment abilities that need tight owner controls.
Install only if you intentionally want an agent to buy goods or services, request top-ups, create payment links, or use x402 payments through CreditClaw. Keep ask-for-everything approval enabled at first, set low per-transaction and daily limits, restrict merchants/categories where possible, protect CREDITCLAW_API_KEY in a secrets manager, avoid logging request bodies or headers, and review auto-approval, payment-link, heartbeat, and x402 settings before enabling them.
### Purchase Request
```bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{### Purchase Request
```bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{### Checkout Request
```bash
curl -X POST https://creditclaw.com/api/v1/bot/merchant/checkout \
-H "Authorization: Bearer $CREDITCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{## How It Works Self-hosted cards use a split-knowledge privacy model. Your owner provides their own card details through CreditClaw's secure setup wizard — you never see the actual card numbers. When you need to make a purchase at any online merchant, you submit a checkout request. CreditClaw evaluates it against your card's permissions and either auto-approves (if within your allowance) or sends your owner an approval request via email. **Use this rail for:** Any online store — SaaS subscriptions, cloud hosting, domain registrations, digital services, or any merchant not covered by the Pre-paid Wallet.
1. You submit a checkout request with merchant and amount details 2. CreditClaw evaluates the request against your card's permissions 3. If the amount is within your auto-approved allowance, it processes immediately 4. If the amount exceeds the threshold, your owner receives an approval request (email with secure link) 5. You poll for the result 6. Once approved, the transaction is recorded
## Allowance Thresholds Your owner sets a per-profile allowance threshold for each card. Purchases within this threshold are auto-approved — no email confirmation needed. Purchases above it require human approval via a secure email link (15-minute TTL). Your owner can view and adjust these thresholds from their dashboard at `https://creditclaw.com/app/self-hosted`.
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.