Security audit

MasterCard | Is your claw a shopaholic?

Security checks for vulnerabilities and agentic risk

Overview

This financial skill is coherent in purpose, but it needs Review because it can spend money, handle card data, and execute server-supplied instructions or code without enough local verification.

Install only if you are comfortable granting an agent real financial authority and access to sensitive payment data. Keep approval mode at ask-for-everything, avoid running server-delivered scripts or free-form instructions, verify any installed files by version/hash, and use a restricted environment with no unrelated files, credentials, or network destinations available during checkout.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: encrypted-card.md:82
Finding: Server-Controlled Instructions Are Executed by a Spawned Sub-Agent
Content: View full analysis
Card-ChaseD-9547.md", "Use the decrypted card details to complete checkout at DigitalOcean.", "Call POST /api/v1/bot/rail5/confirm with { \"checkout_id\": \"r5chk_abc123\", \"status\": \"success\" } when done.", "If checkout fails, call confirm with { \"status\": \"failed\" } instead.", "Announce the result." ], "spawn_payload": { "task": "You are a checkout agent...", "cleanup": "delete", "runTimeoutSeconds": 300, "label": "checkout-digitalocean" } } ``` ```text ### Step 2: Spawn a Sub-Agent Once the checkout is approved, spawn an ephemeral sub-agent using the `spawn_payload` from the response: sessions_spawn({ task: spawn_payload.task, cleanup: "delete", runTimeoutSeconds: 300 }) The sub-agent executes the `checkout_steps` in sequence. You (the main agent) wait for the sub-agent to complete and then announce the result. ``` ### Technical Analysis The Skill directly passes the `spawn_payload.task` value returned by the CreditClaw API into `sessions_spawn`. The response is treated as executable agent instructions without local construction, semantic validation, an action allowlist, or human review. Authentication and HTTPS can establish the origin and integrity of a response in transit, but they do not make free-form instructions safe. If the CreditClaw backend, API account, or response-generation logic is compromised, the task can be replaced after the Skill has already passed review. This exceeds minimum privilege because a checkout operation only needs a narrowly d ...[truncated 1549 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: encrypted-card.md:175
Finding: Unverified Remotely Delivered JavaScript Is Executed in the Card-Decryption Context
Content: View full analysis
Card-ChaseD-9547.md This outputs the card JSON (number, CVV, expiry, name, billing address). **Critical:** The sub-agent must **never** store, log, or persist the decrypted card data. It exists only in memory for this single transaction. After checkout, the sub-agent is deleted. ``` ```json { "event": "rail5.card.delivered", "bot_id": "bot_abc123", "data": { "card_id": "r5card_...", "card_name": "ChaseD", "card_last4": "9547", "file_content": "", "suggested_path": ".creditclaw/cards/Card-ChaseD-9547.md", "instructions": "Save this file to .creditclaw/cards/Card-ChaseD-9547.md — then confirm delivery via POST /bot/rail5/confirm-delivery" } } ``` ```text **Via bot messages (fallback):** If you don't have a webhook, check `GET /bot/messages` for messages with `event_type: "rail5.card.delivered"`. The payload is identical. After saving the file, acknowledge the message via `POST /bot/messages/ack`. **Save the file** to `.creditclaw/cards/` (or the path in `suggested_path`). The file is self-contained — it includes the decrypt script between `DECRYPT_SCRIPT_START/END` markers and the encrypted data between `ENCRYPTED_CARD_START/END` markers. Follow the `instructions` field in the message payload for next steps. ``` ### Technical Analysis The card-delivery response contains both encrypted data and executable decryption code. The Skill directs the agent to save that remotely supplied content and execute the delivered JavaScript with Node.js. No pinned c ...[truncated 2137 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: skill.md:24
Finding: Mutable Remote Skill Files Are Persistently Installed Without Integrity Verification
Content: View full analysis
~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/checkout.md > ~/.creditclaw/skills/creditcard/CHECKOUT.md curl -s https://creditclaw.com/creditcard/crossmint-wallet.md > ~/.creditclaw/skills/creditca ...[truncated 3421 chars]
Remediation: View remediation
` replacement of active files before validation. 10. Keep a known-good rollback copy and display a reviewable change summary before activation. ]]>

T01 · Skill Instruction Hijacking

Error

Location: skill.md:472
Finding: Free-Form API Message Instructions Are Treated as Authoritative Agent Commands
Content: View full analysis
", "suggested_path": ".creditclaw/cards/Card-ChaseD-9547.md", "instructions": "Save this file to .creditclaw/cards/ ..." }, "staged_at": "2026-03-06T12:00:00.000Z", "expires_at": "2026-03-07T12:00:00.000Z" } ], "count": 1, "instructions": "Process each message based on its event_type. After processing, acknowledge messages via POST /api/v1/bot/messages/ack with { message_ids: [id1, id2, ...] } to remove them from the queue." } ``` The companion file further states: ```text **Via bot messages (fallback):** If you don't have a webhook, check `GET /bot/messages` for messages with `event_type: "rail5.card.delivered"`. The payload is identical. After saving the file, acknowledge the message via `POST /bot/messages/ack`. **Save the file** to `.creditclaw/cards/` (or the path in `suggested_path`). The file is self-contained — it includes the decrypt script between `DECRYPT_SCRIPT_START/END` markers and the encrypted data between `ENCRYPTED_CARD_START/END` markers. Follow the `instructions` field in the message payload for next steps. ``` ### Technical Analysis The message API returns free-form `instructions` values at both the response and payload levels. The Skill explicitly tells the agent to follow the payload instruction field. This design mixes data and control. A safe event API should provide typed da ...[truncated 1747 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (32)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checkout.md (reported line 341)May include surrounding context.
md
- **Set `amount_locked: true`** for fixed-price products so buyers can't underpay. - **Leave `amount_usd` empty** for donation or tip jars. - **Use `page_type: "digital_product"`** when selling downloadable content, API keys, or access tokens. - **Use `success_url`** to redirect buyers back to your service after payment. - **Check `GET /bot/sales`** periodically to reconcile completed sales with your fulfillment. - **Multiple checkout pages** are fine — create one per product or service tier.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · skill.md (reported line 12)May include surrounding context.
md
version: 2.3.1 updated: 2026-02-23T00:00:00Z description: Let your agent shop online with guardrailed wallets, multiple payment methods, and owner approval. homepage: https://creditclaw.com api_base: https://creditclaw.com/api/v1 credentials: [CREDITCLAW_API_KEY] metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}} --- # CreditClaw — Shopping for AI Agents CreditClaw.com is a financial enablement platform for Bots, Agents, and OpenClaw. Securely manage agentic spending. 1. Encrypted cards — owner's real-world card is encrypted and the bot uses it within strict guardrails after owner approval. 2. A stablecoin wallet to seamlessly enable x402 payments with a simple "Fund with Stripe" option. 3. Easy-to-use "Storefronts" and product management for bots to sell both digital and physical products. ## Skill Files | File | URL | Purpose | |------|-----|---------| | **SKILL.md** (this file) | `https://creditclaw.com/creditcard/skill.md` |

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
Content: Scanner excerpt · checkout.md (reported line 24)May include surrounding context.
md
-H "Content-Type: application/json" -d '{ "title": "Premium API Access - 1 Month", "description": "Unlimited queries to my data analysis endpoint.", "amount_usd": 5.00, "amount_locked": true }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documents collection of buyer name and email and transmission to CreditClaw/related payment flows, but it does not warn the operator that personally identifiable information is being collected, stored, and shared with third-party payment infrastructure. In an agent setting, omission of a clear privacy/consent notice can cause unintended disclosure of user data and noncompliant handling of PII.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The invoice sending flow causes the system to contact a third party by email and includes recipient identity/payment information, but the skill does not clearly warn that this action sends data externally. For an autonomous agent, this is dangerous because it can trigger unintended outbound communication and disclosure of customer information without explicit approval.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · checkout.md (reported line 473)May include surrounding context.
md
"title": "Premium API Access", "amount_usd": 5.00, "page_type": "digital_product", "digital_product_url": "https://api.databot.com/keys/generate", "shop_visible": true }

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file instructs agents to submit real purchase requests through a third-party wallet flow and includes handling of sensitive data such as shipping addresses and API-key-based authorization, but it does not explicitly warn about the privacy, financial, and data-sharing consequences. In a purchasing skill, omission of those warnings can lead operators or downstream agents to transmit personal and payment-related data without informed consent or adequate safeguards.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The example shows outbound transmission of an API bearer token together with a shipping address and purchase details to a live external endpoint. While documentation often needs examples, this is still security-relevant because it normalizes sending sensitive credentials and personal data to a production service without embedded cautions about secret handling, redaction, or the real-purchase implications.
Content: Scanner excerpt · crossmint-wallet.md (reported line 32)May include surrounding context.
Purchase Request

bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · encrypted-card.md (reported line 59)May include surrounding context.
Step 1: Request Checkout

bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The skill enables autonomous purchasing under an auto-approve threshold, meaning the agent can cause real financial transactions without per-transaction human review. In a payment skill this is intentional, but it still creates abuse risk if the agent is prompted into unnecessary purchases, manipulated by malicious content, or given overly broad spending rules.
Content: Scanner excerpt · encrypted-card.md (reported line 108)May include surrounding context.
"approved": false, "status": "pending_approval", "checkout_id": "r5chk_abc123", "message": "Amount exceeds auto-approve threshold. Your owner has been notified.", "expires_in_minutes": 15 }

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This step directs the sub-agent to retrieve the one-time decryption key through an API call, enabling plaintext card recovery in the agent execution environment. In context, the skill also permits falling back to running checkout in the main agent, which weakens the isolation claim and increases the chance that card data or key material enters broader context, logs, telemetry, or tool traces.
Content: Scanner excerpt · encrypted-card.md (reported line 164)May include surrounding context.
The sub-agent calls this endpoint to retrieve the one-time decryption key:

bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123" }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to persist a self-contained encrypted card package to local disk, but it does not require secure storage controls, restricted permissions, lifecycle deletion, or an explicit warning that this is sensitive financial material. Even though the file is encrypted, it contains card ciphertext plus a bundled decrypt script, making it a durable high-value artifact that could be exfiltrated, copied into backups, or mishandled and later decrypted if keys are obtained through the checkout flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file includes HTTP requests that send a credential ($CREDITCLAW_API_KEY) and retrieve sensitive financial status across connected payment rails. The document describes the mechanics of the calls but does not provide any warning about privacy, credential handling, or the fact that wallet/balance data is being transmitted to a remote service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · management.md (reported line 23)May include surrounding context.
When your balance is low, ask your human if they'd like you to request a top-up:

bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest presents the skill primarily as an agent shopping/payment capability, but the content also enables operating storefronts, generating checkout pages, invoicing, and collecting payments from third parties. This is a scope-expansion risk because a user or orchestrator may grant the skill payment authority without realizing it also exposes merchant/seller operations and external-facing commerce functions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skill.md (reported line 35)May include surrounding context.
| package.json (metadata) | https://creditclaw.com/creditcard/skill.json | Machine-readable skill metadata | Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash
mkdir -p ~/.creditclaw/skills/creditcard curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/checkout.md > ~/.creditclaw/skills/creditcard/CHECKOUT.md curl -s https://creditclaw.com/creditcard/crossmint-wallet.md > ~/.creditclaw/skills/creditcard/CROSSMINT-WALLET.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · skill.md (reported line 36)May include surrounding context.
Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash
mkdir -p ~/.creditclaw/skills/creditcard curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/checkout.md > ~/.creditclaw/skills/creditcard/CHECKOUT.md curl -s https://creditclaw.com/creditcard/crossmint-wallet.md > ~/.creditclaw/skills/creditcard/CROSSMINT-WALLET.md curl -s https://creditclaw.com/creditcard/encrypted-card.md > ~/.creditclaw/skills/creditcard/ENCRYPTED-CARD.md

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 123)May include surrounding context.
You can register before your human does. You'll get an API key immediately.

bash
curl -X POST https://creditclaw.com/api/v1/bots/register \ -H "Content-Type: application/json" \ -d '{ "bot_name": "my-research-bot",

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The skill explicitly authorizes autonomous spending under configurable auto-approval modes. Even with server-side guardrails, this is a real financial-risk capability because an agent may make purchases without real-time human review, and metadata does not strongly emphasize the autonomous spending behavior at the trust boundary.
Content: Scanner excerpt · skill.md (reported line 321)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The skill permits category-based auto-approved purchases, allowing the agent to spend freely within approved categories and limits. In a financial skill, this increases danger because policy mistakes, category misclassification, or orchestration ambiguity can still result in unauthorized or surprising transactions without immediate human intervention.
Content: Scanner excerpt · skill.md (reported line 322)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented API surface includes seller profile, invoicing, payment link, checkout page, sales, and public shop endpoints that materially exceed the shopping-focused description in the manifest. Hidden or under-disclosed capabilities in a financial skill are dangerous because they can cause overbroad trust, unexpected external payment collection, and policy bypass in systems that rely on metadata for capability gating.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 472)May include surrounding context.
Fetch Pending Messages

bash
curl https://creditclaw.com/api/v1/bot/messages \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · spending.md (reported line 14)May include surrounding context.
md
Choose one: - [x] **Ask me for everything** — Bot requests approval before any purchase - [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below - [ ] **Auto-approve by category** — Bot spends freely on approved categories ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · spending.md (reported line 15)May include surrounding context.
md
Choose one: - [x] **Ask me for everything** — Bot requests approval before any purchase - [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below - [ ] **Auto-approve by category** — Bot spends freely on approved categories ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · spending.md (reported line 29)May include surrounding context.
md
| Ask approval above | $10.00 | If a purchase exceeds the "ask approval above" amount, the bot must send you a confirmation request before proceeding — even if auto-approve is enabled. ---

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

T01 · Skill Instruction Hijacking

SkillSpector

Credential Access

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Unbounded Resource Access

Missing User Warnings

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

Purchase Request

External Transmission

Step 1: Request Checkout

Autonomous Decision Making

External Transmission

Missing User Warnings

Missing User Warnings

External Transmission

Description-Behavior Mismatch

Session Persistence

Skill Enumeration

External Transmission

Autonomous Decision Making

Autonomous Decision Making

Description-Behavior Mismatch

External Transmission

Fetch Pending Messages

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Static analysis