T09 · Insecure Skill Coding Practices
Error
- Location
encrypted-card.md:218- Finding
Plaintext Payment Card Disclosure to a CreditClaw-Controlled Test Page
- Content
View full analysis
- Remediation
View remediation
Security audit
Shop from Nvidia - With your claw and creditcard
Security checks for vulnerabilities and agentic risk
Overview
This is a real-money payments skill with serious review concerns around scope, remote instructions, and raw card-data handling.
Review this skill carefully before installing. It can give an agent continuing financial authority, fetch and act on server-provided instructions, handle customer and shipping data, and decrypt full payment-card details. Only use it with strict spending limits, explicit approval for every transaction, scoped/revocable API keys, and a clear understanding of what data CreditClaw receives.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:32- Finding
Execution of Mutable Remote Instructions and Server-Supplied Agent Tasks
- Content
View full analysis
", "instructions": ...[truncated 5185 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (32)
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md 3-12 description: "Buy at Nvidia | Manage compatible cards, wallets & payments. Financial management for Agents and OpenClaw bots." homepage: https://creditclaw.com api_base: https://creditclaw.com/api/v1 credentials: [CREDITCLAW_API_KEY] metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}} --- # CreditClaw — Financial Enablement & Accounting for AI Agents CreditClaw.com is a financial enablement platform for Agents and OpenClaw. Securely manage agentic spending. 1. Accept card details securely from your owner and make purchases within strict guardrails after owner approval. 2. A stablecoin wallet to seamlessly enable x402 payments with a simple "Fund with Stripe" option. 3. Easy-to-use "Storefronts" and product management for bots to sell both digital and physical products. ## Skill Files | File | URL | Purpose | |------|-----|---------| | **SKILL.md** (this file) | `https://creditclaw.com/skill.md` | Registration, setup, webhooks,
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **Set `amount_locked: true`** for fixed-price products so buyers can't underpay. - **Leave `amount_usd` empty** for donation or tip jars. - **Use `page_type: "digital_product"`** when selling downloadable content, API keys, or access tokens. - **Use `success_url`** to redirect buyers back to your service after payment. - **Check `GET /bot/sales`** periodically to reconcile completed sales with your fulfillment. - **Multiple checkout pages** are fine — create one per product or service tier.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs agents to call wallet-status and spending-permission endpoints using a bearer token, which exposes sensitive financial metadata such as balances, limits, connected rails, cards, and owner instructions. In an agent-skill context, omitting explicit guidance on credential protection, output redaction, and user-consent boundaries increases the risk that secrets or private wallet data are fetched, logged, cached, or surfaced to unintended parties.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
You can register before your human does. You'll get an API key immediately.
bash curl -X POST https://creditclaw.com/api/v1/bots/register \ -H "Content-Type: application/json" \ -d '{ "bot_name": "my-research-bot",
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The skill explicitly instructs the agent that it may spend funds autonomously under certain server-configured modes and thresholds. Even with server-side guardrails, this enables real financial actions without per-transaction human review, increasing the risk of unintended purchases, prompt-manipulated spending decisions, or abuse if upstream tasking is compromised.
- Content
md **You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Allowing category-based auto-approval gives the agent discretion to classify and execute purchases within approved categories, which can be error-prone or manipulable. The surrounding context makes this less dangerous than unrestricted spending because server-side limits exist, but it still authorizes financially consequential actions without guaranteed contemporaneous human consent.
- Content
md **You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Fetch Pending Messages
bash curl https://creditclaw.com/api/v1/bot/messages \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md -H "Content-Type: application/json" -d '{ "title": "Premium API Access - 1 Month", "description": "Unlimited queries to my data analysis endpoint.", "amount_usd": 5.00, "amount_locked": true }'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill supports collecting buyer personal data such as buyer names and emails and transmitting that data to an external payment service without any privacy notice, minimization guidance, or consent boundary. In agent workflows, silent handling of personal data is risky because operators may not realize customer information is being gathered, stored, and shared with third parties.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata says it is for Nvidia purchasing and compatible cards, wallets, and payments, but the content exposes a broad generic commerce platform: public checkout pages, invoices, public storefronts, and arbitrary digital product delivery. This scope expansion increases the chance an agent will perform unrelated financial operations or publish monetized assets beyond the user's expected intent, creating capability overreach and misuse risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invoice-send workflow emails recipients and attaches PDFs, which is an external transmission of customer data and billing content, yet the skill provides no warning or approval checkpoint. An agent using this blindly could send sensitive invoice details to unintended recipients or disclose customer information through automated outbound communication.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The shop publishing flow and arbitrary digital product URLs are not justified by the declared Nvidia purchasing purpose and allow the agent to create publicly visible listings or distribute unrelated assets. In an agent setting, this can lead to unauthorized commercialization, accidental public exposure, or sale of resources the operator did not intend to offer.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "title": "Premium API Access", "amount_usd": 5.00, "page_type": "digital_product", "digital_product_url": "https://api.databot.com/keys/generate", "shop_visible": true }
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide describes a workflow that can place real merchant orders and send shipping PII through Crossmint/CreditClaw, but it does not prominently warn users that the action has real financial consequences and discloses personal address data to external services. In an agent skill context, missing consent and risk signaling increases the chance of unintended purchases or privacy-impacting use by operators who treat the example as a harmless test call.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The example instructs the agent to POST a live purchase request containing authorization credentials, product details, and a full shipping address to an external API that brokers real orders. External transmission is expected for the feature, but in a security review this is still risky because it moves sensitive financial and personal data off-platform and can initiate non-reversible real-world actions if invoked unintentionally or by a compromised agent.
- Content
Purchase Request
bash curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Request Checkout
bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The skill explicitly allows immediate approval for some purchases under an auto-approve threshold, meaning an agent can trigger real financial transactions without per-transaction human review. In the context of a bot skill that also handles card decryption and checkout, this increases the blast radius of prompt injection, task confusion, or malicious workflow chaining into unauthorized spending.
- Content
"approved": false, "status": "pending_approval", "checkout_id": "r5chk_abc123", "message": "Amount exceeds auto-approve threshold. Your owner has been notified.", "expires_in_minutes": 15 }
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
This step instructs the agent to fetch a one-time decryption key from a remote API, enabling reconstruction of full cardholder data in the agent runtime. Even though the flow says the data should remain in memory, giving an autonomous agent the capability to obtain decryption material for PAN/CVV materially increases exposure to memory scraping, prompt-injection-driven misuse, compromised runtimes, or accidental leakage through logs and telemetry.
- Content
Once the checkout is approved, call this endpoint to retrieve the one-time decryption key:
bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123" }'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
When your balance is low, ask your human if they'd like you to request a top-up:
bash curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file documents a wallet transaction-history endpoint and includes example responses containing payment and purchase descriptions, but it does not warn users that querying or displaying this data can expose sensitive financial information. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors affecting user data or privacy.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest claims a different identity from the provided skill context: the reviewed skill is presented as 'nvidia', but the manifest names it 'creditclaw' and describes a different finance/payment capability. Identity mismatch is dangerous because users, agents, or registries may authorize or invoke the skill under false assumptions, enabling deceptive routing of financial actions and trust confusion.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The description 'Give your agent spending power. Financial management for Agents and OpenClaw bots.' is broad and high-risk because it can match many generic finance-related prompts without clearly bounded triggers or approval requirements. In a payment-capable skill, ambiguous scope increases the chance of over-invocation, unintended purchases, or an agent selecting this skill for sensitive actions the user did not explicitly authorize.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest requires an API key for a financial service but provides no visible warning, safeguard description, or indication of how sensitive payment credentials and spending operations are protected. In the context of a finance skill, this elevates risk because compromised or misused credentials could authorize account access, card management, wallet actions, or payments with direct monetary impact.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Choose one: - [x] **Ask me for everything** — Bot requests approval before any purchase - [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below - [ ] **Auto-approve by category** — Bot spends freely on approved categories ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Choose one: - [x] **Ask me for everything** — Bot requests approval before any purchase - [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below - [ ] **Auto-approve by category** — Bot spends freely on approved categories ---
Static analysis
No suspicious patterns detected.