T01 · Skill Instruction Hijacking
Error
- Location
agents/OPENCLAW.md:151- Finding
Server-Controlled Sub-Agent Instructions Execute in a Privileged Financial Context
- Content
View full analysis
- Remediation
View remediation
Security audit
Shopping Claw | Is your claw a shopaholic?
Security checks for vulnerabilities and agentic risk
Overview
This payment skill is coherent about enabling agent purchases, but it gives agents broad financial authority while trusting remote free-form instructions in checkout flows.
Review this carefully before installing. It can spend real money, use an API key tied to a wallet, retrieve keys that decrypt payment-card details, and automate checkout. Keep approval mode set to ask_for_everything unless you fully trust the service, avoid broad auto-approval rules, use strict merchant and amount limits, monitor the dashboard, and do not use it where remote Markdown or message instructions can be treated as trusted commands without extra validation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
SHOPPING-GUIDE.md:26- Finding
Remote Vendor Markdown Is Trusted as Checkout Instructions
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:325- Finding
Free-Form Instructions from Financial Message Payloads Are Treated as Trusted Commands
- Content
View full analysis
", "instructions": "Accept the encrypted card details and confirm delivery via POST /bot/rail5/confirm-delivery" }, "staged_at": "2026-03-06T12:00:00.000Z", "expires_at": "2026-03-07T12:00:00.000Z" } ], "count": 1, "instructions": "Process each message based on its event_type. After processing, acknowledge messages via POST /api/v1/bot/messages/ack with { message_ids: [id1, id2, ...] } to remove them from the queue." } ``` ### Technical Analysis The Skill explicitly directs the agent to follow an `instructions` field received through polling or webhook event payloads. These fields are free-form server-controlled text rather than constrained event data. Webhook HMAC verification, where used, authenticates that the event was produced by a holder of the webhook secret. It does not make arbitrary natural-language instructions safe and does not protect against ...[truncated 2156 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (42)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The skill explicitly suggests using digital-product checkout flows to sell API keys or access tokens, but provides no safety guidance on secure issuance, scoping, expiration, one-time retrieval, or storage. In agent contexts, this can lead to automated creation and delivery of long-lived credentials that may be exposed in logs, callbacks, URLs, or misdirected fulfillment flows.
- Content
md - **Set `amount_locked: true`** for fixed-price products so buyers can't underpay. - **Leave `amount_usd` empty** for donation or tip jars. - **Use `page_type: "digital_product"`** when selling downloadable content, API keys, or access tokens. - **Use `success_url`** to redirect buyers back to your service after payment. - **Check `GET /bot/sales`** periodically to reconcile completed sales with your fulfillment. - **Multiple checkout pages** are fine — create one per product or service tier.
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: payment description: "Shopping Claw | Give your agent spending power. Financial management for Agents and OpenClaw bots." metadata: openclaw: requires: env: - CREDITCLAW_API_KEY invocation: user_confirmed --- # CreditClaw — Financial Enablement & Accounting for AI Agents CreditClaw.com is a financial enablement platform for Bots, Agents, and OpenClaw. Securely manage agentic spending. 1. Accept card details securely from your owner and make purchases within strict guardrails after owner approval. 2. A stablecoin wallet to seamlessly enable x402 payments with a simple "Fund with Stripe" option. 3. Easy-to-use "Storefronts" and product management for bots to sell both digital and physical products. ## Skill Files All companion files are bundled in this skill directory. | File | Purpose | |------|---------| | `SKILL.md` (this file) | Registration, c
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` (this file) | Registration, card setup, status, spending permissions, API reference |
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill includes explicit instructions to capture and enter raw payment card data, including PAN and CVV, into checkout fields and payment iframes, but provides no safety boundaries, consent requirements, PCI scope warnings, or restrictions on handling decrypted card data. In an agent-payment skill, this is especially dangerous because it operationalizes direct processing of highly sensitive financial data and could enable unauthorized charges, insecure storage/exposure of card data, or non-compliant automated payment handling.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This guidance explicitly recommends using a one-click payment path ("Buy it now") and proceeding through checkout without requiring any explicit user confirmation, sandbox restriction, or warning that the action can place a real order and charge a payment method. In a payment-enabled agent skill, that omission is dangerous because it normalizes autonomous purchase completion and increases the risk of unintended or unauthorized financial transactions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file provides operational instructions for entering decrypted card number and CVV into checkout iframes, including step-by-step handling of sensitive payment fields, without any warning about PCI scope, secret minimization, or safe handling of payment credentials. In the context of a spending-enabled agent skill, this materially increases the chance that plaintext card data will be exposed to logs, memory, snapshots, or misuse by an automated agent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Request Checkout
bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
"approved": false, "status": "pending_approval", "checkout_id": "r5chk_abc123", "message": "Amount exceeds auto-approve threshold. Your owner has been notified.", "expires_in_minutes": 15 }
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This step retrieves a decryption key for payment card data over an external API, enabling the agent to obtain plaintext card details and use them in a browser checkout flow. Even though the guide warns not to persist the data, granting an agent access to decrypt and handle PAN/CVV materially increases exposure to card theft, memory scraping, misuse by compromised agent logic, or accidental leakage through tools, traces, or screenshots.
- Content
Step 2: Get Decryption Key
bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123" }'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 6: Confirm Checkout
bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/confirm \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123", "status": "success" }'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The heartbeat routine instructs an agent to make authenticated outbound requests using a bearer API key, but it provides no user-facing notice about credential use or what data will be transmitted to the remote service. In an agent-skill context, this can cause silent disclosure of wallet status, messages, and other sensitive payment metadata to an external system without explicit operator awareness or consent at execution time.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This instruction causes authenticated external transmission to a third-party endpoint using a bearer token, exposing sensitive operational context such as pending payment-related messages to a remote service. While contacting the service is part of the skill's purpose, the lack of safeguards, disclosure, or consent makes it a real security concern in environments where agent actions should be transparent and minimally permissioned.
- Content
1. Check Messages (Every 30 Minutes)
bash curl https://creditclaw.com/api/v1/bot/messages \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The POST to /bot/messages/ack is a state-changing action that marks messages as processed, but the instructions do not clearly warn that acknowledgement is destructive from a workflow perspective. An agent following this blindly could erase pending approvals, alerts, or audit-relevant messages before a human reviews them, reducing visibility and potentially affecting payment decisions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Check your current profile:
bash curl https://creditclaw.com/api/v1/bot/profile \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md -H "Content-Type: application/json" -d '{ "title": "Premium API Access - 1 Month", "description": "Unlimited queries to my data analysis endpoint.", "amount_usd": 5.00, "amount_locked": true }'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file documents invoice and sales APIs that collect and expose buyer personal data such as recipient_name, recipient_email, and buyer_email, but it does not warn operators that they are handling third-party personal data. In an agent skill, this omission is risky because agents may automatically send, store, or log PII without user awareness, increasing privacy, compliance, and data-handling risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "title": "Premium API Access", "amount_usd": 5.00, "page_type": "digital_product", "digital_product_url": "https://api.databot.com/keys/generate", "shop_visible": true }
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This guide explicitly instructs the agent to proceed into checkout, identify payment form types, and fill payment fields, but it does not present an immediate user-facing safety gate, transaction confirmation warning, or explicit limit on when those actions may occur. In a payment skill, that omission is especially dangerous because it normalizes high-impact financial actions and increases the chance of unauthorized purchases, premature card entry, or misuse of decrypted payment data by downstream agent flows.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - **Claim tokens are single-use.** The token linking you to your owner is invalidated immediately after use and cannot be replayed. - **Card details are protected with AES-256-GCM encryption.** Your owner's card details are encrypted and the decryption key is held server-side, issued only once per approved checkout. Decrypted card data must never be stored, logged, or persisted — it exists only in memory for the duration of a single transaction. - **Checkout sessions are ephemeral.** Card details are decrypted only for the duration of a single checkout and discarded immediately after. This ensures sensitive data cannot leak across sessions or persist. - **Sub-agents isolate card data.** On OpenClaw, every checkout is handled by an ephemeral sub-agent that is automatically deleted after the transaction. Your main agent never sees decrypted card details. See `agents/OPENCLAW.md`. - **Decryption keys are single-use and server-issued.** Each checkout gets a unique key that is invalidated after retrieval. There is no way to re-request a key for the same checkout. - **Per-endpoint rate limiting.** All bot API endpoints are rate-limited to prevent abuse. - **Access logging.** Every API call you make is logged with endpoint, method, status code, IP, and response time — visible to your owner.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - **Claim tokens are single-use.** The token linking you to your owner is invalidated immediately after use and cannot be replayed. - **Card details are protected with AES-256-GCM encryption.** Your owner's card details are encrypted and the decryption key is held server-side, issued only once per approved checkout. Decrypted card data must never be stored, logged, or persisted — it exists only in memory for the duration of a single transaction. - **Checkout sessions are ephemeral.** Card details are decrypted only for the duration of a single checkout and discarded immediately after. This ensures sensitive data cannot leak across sessions or persist. - **Sub-agents isolate card data.** On OpenClaw, every checkout is handled by an ephemeral sub-agent that is automatically deleted after the transaction. Your main agent never sees decrypted card details. See `agents/OPENCLAW.md`. - **Decryption keys are single-use and server-issued.** Each checkout gets a unique key that is invalidated after retrieval. There is no way to re-request a key for the same checkout. - **Per-endpoint rate limiting.** All bot API endpoints are rate-limited to prevent abuse. - **Access logging.** Every API call you make is logged with endpoint, method, status code, IP, and response time — visible to your owner.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
"cash_advances" ], "recurring_allowed": false, "notes": "Prefer free tiers before paying. Always check for discount codes. No annual plans without asking me first.", "updated_at": "2026-02-06T18:00:00Z" }
text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The skill explicitly authorizes autonomous purchases under certain policy modes, which creates real-world financial risk if the agent misclassifies purchases, interprets categories incorrectly, or is manipulated by downstream prompts or merchant content. Even with server-side guardrails, this still enables agent-initiated spending without per-transaction human review.
- Content
md **You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Auto-approval by category permits the agent to decide when spending is allowed, which can be abused through category confusion, adversarial merchant descriptions, or prompt manipulation during shopping flows. The surrounding context makes this more dangerous because the skill is designed to complete purchases, so mistakes translate directly into monetary loss.
- Content
md **You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Fetch Pending Messages
bash curl https://creditclaw.com/api/v1/bot/messages \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document explicitly enables an agent to spend funds and transmit payment-related metadata using an API key, but it does not present a prominent warning about real financial consequences, secret handling, or the need for explicit owner consent before payment actions. In an agent-skill context, that omission is security-relevant because it increases the chance of unreviewed autonomous purchases, accidental budget depletion, or unsafe propagation of sensitive credentials into logs and downstream tools.
- Content
Static analysis
No suspicious patterns detected.