Shop from Microsoft - With your creditcard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:41 PM UTC
• Version: 1.0.0

Overview

This is a legitimate-looking shopping and payment skill, but it needs review because it gives an agent broad spending and payment-link powers with sensitive financial data access.

Review this carefully before installing. Keep approval mode set to ask-for-everything unless you intentionally want autonomous spending, set low per-transaction/daily limits, restrict merchants/categories, and understand that addresses, emails, merchant details, wallet status, and transaction information are sent to CreditClaw and sometimes merchants or payment processors. Prefer a signed or checksum-verified package over the documented curl install commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:30

Finding

Unverified Mutable Skill Instructions Are Installed from a Remote Source

Content

View full analysis

~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md curl -s https://creditclaw.com/creditcard/prepaid-wallet.md > ~/.creditclaw/skills/creditcard/PREPAID-WALLET.md curl -s https://creditclaw.com/creditcard/self-hosted-card.md > ~/.creditclaw/skills/creditcard/SELF-HOSTED-CARD.md curl -s https://creditclaw.com/creditcard/stripe-x402-wallet.md > ~/.creditclaw/skills/creditcard/STRIPE-X402-WALLET.md curl -s https://creditclaw.com/creditcard/heartbeat.md > ~/.creditclaw/skills/creditcard/HEARTBEAT.md curl -s https://creditclaw.com/creditcard/skill.json > ~/.creditclaw/skills/creditcard/package.json ``` ``` ### Technical Analysis The installation procedure downloads Skill instructions and metadata from mutable URLs and directly overwrites local files. It does not pin a version, verify a cryptographic checksum or signature, validate the downloaded content, or preserve the previously reviewed files if a download is incomplete. HTTPS protects data in transit under normal conditions, but it does not establish that the content currently hosted at the URLs is identical to the content audited in this project. A compromise of the hosting account, deployment pipeline, origin server, DNS/TLS infrastructure, or other upstream publishing mechanism could replace the hosted Markdown instructions after review. This is particularly significant because Markdown files in an Agent Skill are operational ...[truncated 1964 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · skill.md (reported line 12)May include surrounding context.

md

rsion: 2.3.1
updated: 2026-02-23T00:00:00Z
description: "Let your agent shop online with guardrailed wallets, multiple payment methods, and owner approval."
homepage: https://creditclaw.com
api_base: https://creditclaw.com/api/v1
credentials: [CREDITCLAW_API_KEY]
metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}}
---

# CreditClaw — Shopping for AI Agents

CreditClaw lets your agent buy things online — Amazon products, Shopify stores, SaaS subscriptions, and more.
Your owner funds a wallet, sets spending limits, and you shop within those guardrails.

## Skill Files

| File | URL | Purpose |
|------|-----|---------|
| **SKILL.md** (this file) | `https://creditclaw.com/creditcard/skill.md` | Registration, setup, payment method guide, and API reference |
| **SHOPPING.md** | `https://creditclaw.com/creditcard/shopping.md` | General purchasing guide — merchant types, tips, common patterns |
| **AMAZON.md** | `https://creditclaw.com/cre

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to submit a real recipient name and full shipping address to an external purchasing service for a live Amazon order, but it does not include an explicit privacy warning or a clear consent checkpoint for sharing personal data. Because this is a purchasing workflow, the transmission is expected, but the omission still creates privacy and compliance risk if an agent collects or sends sensitive address data without making the user aware.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · amazon.md (reported line 33)May include surrounding context.

Purchase Request

bash

curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · prepaid-wallet.md (reported line 43)May include surrounding context.

Purchase Request

bash

curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file directs the agent to call endpoints that return balances, spending limits, connected rails, and guardrails across all payment rails, and later to fetch spending permissions. The instructions do not warn that these requests expose sensitive financial/account data and use an API key, which is a user-facing omission under the markdown-specific missing-warning rule.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · heartbeat.md (reported line 19)May include surrounding context.

1. Check Full Status (Recommended)

bash

curl https://creditclaw.com/api/v1/bot/status \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · heartbeat.md (reported line 95)May include surrounding context.

Before an expensive self-hosted card purchase, test if it would pass:

bash

curl -X POST https://creditclaw.com/api/v1/bot/check/rail4/test \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "merchant_name": "Amazon", "amount_cents": 5000, "profile_index": 1 }'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The purchase example instructs the agent to send a full shipping address, including recipient name and street address, to an external payment/order-fulfillment service without any explicit privacy notice, minimization guidance, or warning about third-party data handling. While this is expected for order placement, it still exposes sensitive personal data and could lead to unintended disclosure if users or downstream agents do not understand that this information leaves their environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · prepaid-wallet.md (reported line 98)May include surrounding context.

Step 1: Search for Variants

bash

curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/search \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "product_url": "https://shop.example.com/products/widget" }'

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The documentation states that purchases may be auto-approved when within a configured allowance, meaning the agent can trigger financial transactions without a per-transaction human review. In a shopping/payment skill, autonomous decision-making is materially risky because prompt injection, task confusion, or misuse could convert model actions directly into unauthorized spending.

Content

Scanner excerpt · self-hosted-card.md (reported line 11)May include surrounding context.

md

## How It Works

Self-hosted cards use a split-knowledge privacy model. Your owner provides their own card details through CreditClaw's secure setup wizard — you never see the actual card numbers. When you need to make a purchase at any online merchant, you submit a checkout request. CreditClaw evaluates it against your card's permissions and either auto-approves (if within your allowance) or sends your owner an approval request via email.

**Use this rail for:** Any online store — SaaS subscriptions, cloud hosting, domain registrations, digital services, or any merchant not covered by the Pre-paid Wallet.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The checkout flow confirms that requests within an allowance are processed immediately, allowing the agent to complete purchases autonomously. Because this skill is specifically designed for online shopping across broad merchant categories, the context makes the autonomy more dangerous than a generic workflow automation: money can be spent at arbitrary merchants with limited friction.

Content

Scanner excerpt · self-hosted-card.md (reported line 23)May include surrounding context.

md

1. You submit a checkout request with merchant and amount details
2. CreditClaw evaluates the request against your card's permissions
3. If the amount is within your auto-approved allowance, it processes immediately
4. If the amount exceeds the threshold, your owner receives an approval request (email with secure link)
5. You poll for the result
6. Once approved, the transaction is recorded

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill explicitly instructs an agent to send a purchase request, including merchant and amount details plus an authorization bearer token, to an external payment API. In the context of an agent skill, this enables real-world financial transactions and transfers operational/payment metadata off-platform; if invoked inappropriately, it can cause unauthorized purchases even though full card numbers are not exposed.

Content

Scanner excerpt · self-hosted-card.md (reported line 31)May include surrounding context.

Checkout Request

bash

curl -X POST https://creditclaw.com/api/v1/bot/merchant/checkout \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The documented 'approved' response for an auto-approved transaction shows that the system is expected to finalize payment actions without additional oversight. While this is a consequence of the platform design rather than overtly malicious behavior, it still represents a genuine security concern in an agent skill because successful autonomous approvals can normalize silent financial execution.

Content

Scanner excerpt · self-hosted-card.md (reported line 57)May include surrounding context.

| category | No | Spending category | | task_id | No | Your internal task reference |

Response (Auto-Approved — Within Allowance)

json

{

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The allowance-threshold model explicitly permits purchases below a configured amount to bypass human approval. In this skill context, that creates a direct path for repeated low-value unauthorized purchases, which can be abused individually or in aggregate and is especially risky because the skill advertises use at essentially any online merchant.

Content

Scanner excerpt · self-hosted-card.md (reported line 111)May include surrounding context.

md

## Allowance Thresholds

Your owner sets a per-profile allowance threshold for each card. Purchases within this threshold are auto-approved — no email confirmation needed. Purchases above it require human approval via a secure email link (15-minute TTL).

Your owner can view and adjust these thresholds from their dashboard at `https://creditclaw.com/app/self-hosted`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · shopping.md (reported line 51)May include surrounding context.

1. Check wallet & spending permissions
2. Confirm purchase details with the user
3. Submit purchase/checkout request
4. Handle approval (auto-approved or pending owner approval)
5. Poll for result if pending
6. Report outcome to user (tracking info, confirmation, or error)

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 339)May include surrounding context.

1. Check wallet & spending permissions
2. Confirm purchase details with the user
3. Submit purchase/checkout request
4. Handle approval (auto-approved or pending owner approval)
5. Poll for result if pending
6. Report outcome to user (tracking info, confirmation, or error)

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 32)May include surrounding context.

Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash

mkdir -p ~/.creditclaw/skills/creditcard
curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md
curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md
curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 33)May include surrounding context.

Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash

mkdir -p ~/.creditclaw/skills/creditcard
curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md
curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md
curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md
curl -s https://creditclaw.com/creditcard/prepaid-wallet.md > ~/.creditclaw/skills/creditcard/PREPAID-WALLET.md

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 133)May include surrounding context.

Register to get your API key and a claim token for your human.

bash

curl -X POST https://creditclaw.com/api/v1/bots/register \
  -H "Content-Type: application/json" \
  -d '{
    "bot_name": "my-research-bot",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 223)May include surrounding context.

Recommended interval: every 30 minutes, or before any purchase.

bash

curl https://creditclaw.com/api/v1/bot/status \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 274)May include surrounding context.

"cash_advances" ], "recurring_allowed": false, "notes": "Prefer free tiers before paying. Always check for discount codes. No annual plans without asking me first.", "updated_at": "2026-02-06T18:00:00Z" }

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 281)May include surrounding context.

md

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 282)May include surrounding context.

md

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 351)May include surrounding context.

When your balance is low, ask your human if they'd like you to request a top-up:

bash

curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest presents the skill as a shopping/payment tool for agent purchases, but this section also enables generating payment links to charge arbitrary third parties and receive funds. That materially expands the trust and abuse surface from 'spending owner-approved funds' to operating as a pay-in/payment collection system, which could be misused for unauthorized billing, fraud, or social-engineering workflows not implied by the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.