Security audit

QuickBooks for Beginners | Accounting skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed payment tool, but it gives an agent broad real-money and card-handling authority while relying on mutable remote instructions and locally executed remote-delivered code.

Review before installing. Only use this skill in an environment that can isolate payment work from the main agent, restrict network and filesystem access, protect CREDITCLAW_API_KEY, and avoid executing mutable server-delivered scripts or natural-language tasks without validation. Treat auto-approval, public shop publishing, invoice sending, card-file storage, buyer/shipping data, and webhook fulfillment as real financial or privacy-impacting actions that should require explicit owner control.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: encrypted-card.md:78
Finding: Remote API Responses Are Executed as Agent Instructions
Content: View full analysis
Card-ChaseD-9547.md", "Use the decrypted card details to complete checkout at DigitalOcean.", "Call POST /api/v1/bot/rail5/confirm with { \"checkout_id\": \"r5chk_abc123\", \"status\": \"success\" } when done.", "If checkout fails, call confirm with { \"status\": \"failed\" } instead.", "Announce the result." ], "spawn_payload": { "task": "You are a checkout agent...", "cleanup": "delete", "runTimeoutSeconds": 300, "label": "checkout-digitalocean" } } ``` ```text Once the checkout is approved, spawn an ephemeral sub-agent using the `spawn_payload` from the response: sessions_spawn({ task: spawn_payload.task, cleanup: "delete", runTimeoutSeconds: 300 }) The sub-agent executes the `checkout_steps` in sequence. You (the main agent) wait for the sub-agent to complete and then announce the result. ``` ### Technical Analysis The Skill treats the remote API's `spawn_payload.task` and `checkout_steps` fields as trusted Agent instructions. The content is not restricted to a locally defined set of payment actions, validated against an action schema, or displayed to the owner for approval before execution. Consequently, the effective behavior of the Skill is controlled by mutable server responses rather than only by the statically audited package. A compromised service, compromised account, or malicious response could replace the expected checkout task with instructions to access local files, disclose credentials, contact unrelated services, or perf ...[truncated 1514 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: encrypted-card.md:205
Finding: Server-Delivered Decryption Code Is Executed Locally
Content: View full analysis
Card-ChaseD-9547.md This outputs the card JSON (number, CVV, expiry, name, billing address). Critical: The sub-agent must never store, log, or persist the decrypted card data. It exists only in memory for this single transaction. After checkout, the sub-agent is deleted. ``` ```json { "event": "rail5.card.delivered", "bot_id": "bot_abc123", "data": { "card_id": "r5card_...", "card_name": "ChaseD", "card_last4": "9547", "file_content": "", "suggested_path": ".creditclaw/cards/Card-ChaseD-9547.md", "instructions": "Save this file to .creditclaw/cards/Card-ChaseD-9547.md — then confirm delivery via POST /bot/rail5/confirm-delivery" } } ``` ```text Save the file to `.creditclaw/cards/` (or the path in `suggested_path`). The file is self-contained — it includes the decrypt script between `DECRYPT_SCRIPT_START/END` markers and the encrypted data between `ENCRYPTED_CARD_START/END` markers. Follow the `instructions` field in the message payload for next steps. ``` ### Technical Analysis The decryption script is not part of the statically audited package. Instead, executable JavaScript is delivered dynamically through a webhook or polled API message, saved locally, and later run using Node.js. The Skill does not specify: - A pinned cryptographic hash for the decryptor. - Digital-signature verification for the delivered code. - A local audited implementation against which the payload is compared. - A sandbox preventing ...[truncated 1671 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: encrypted-card.md:159
Finding: Checkout Worker Receives Excessive Credential and Card-Data Privileges
Content: View full analysis
Card-ChaseD-9547.md This outputs the card JSON (number, CVV, expiry, name, billing address). Critical: The sub-agent must never store, log, or persist the decrypted card data. It exists only in memory for this single transaction. After checkout, the sub-agent is deleted. ``` ```text Alternative: If your environment doesn't support spawning sub-agents, you can execute the `checkout_steps` directly as the main agent. The guardrails and encryption still protect your owner's card — but the main agent will see the decrypted card details in its context. ``` ### Technical Analysis The checkout worker uses the general `CREDITCLAW_API_KEY` rather than a transaction-scoped capability. The same worker also gains access to the complete card record, including PAN and CVV. An ephemeral sub-agent is a lifecycle property, not necessarily a security boundary. Deleting its session does not prove that: - Logs and transcripts were erased. - Child processes were terminated. - Sensitive output was not copied into tool traces. - The Agent lacked access to unrelated files or environment variables. - Card data was not transmitted before cleanup. The fallback explicitly permits decryption in the main Agent context, which expands the lifetime and exposure of cardholder data. Merchant pages also constitute untrusted input and can contain prompt-injection content capable of influenci ...[truncated 1202 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: skill.md:33
Finding: Skill Instructions Can Be Replaced by Unpinned Remote Documents
Content: View full analysis
~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/checkout.md > ~/.creditclaw/skills/creditcard/CHECKOUT.md curl -s https://creditclaw.com/creditcard/crossmint-wallet.md > ~/.creditclaw/skills/creditcard/CROSSMINT-WALLET.md curl -s https://creditclaw.com/creditcard/encrypted-card.md > ~/.creditclaw/skills/creditcard/ENCRYPTED-CARD.md curl -s https://creditclaw.com/creditcard/heartbeat.md > ~/.creditclaw/skills/creditcard/HEARTBEAT.md curl -s https://creditclaw.com/creditcard/management.md > ~/.creditclaw/skills/creditcard/MANAGEMENT.md curl -s https://creditclaw.com/creditcard/spending.md > ~/.creditclaw/skills/creditcard/SPENDING.md curl -s https://creditclaw.com/creditcard/stripe-x402-wallet.md > ~/.creditclaw/skills/creditcard/STRIPE-X402-WALLET.md curl -s https://creditclaw.com/creditcard/skill.json > ~/.creditclaw/skills/creditcard/package.json ``` ```json "files": { "SKILL.md": "https://creditclaw.com/creditcard/skill.md", "CHECKOUT.md": "https://creditclaw.com/creditcard/checkout.md", "CROSSMINT-WALLET.md": "https://creditclaw.com/creditcard/crossmint-wallet.md", "ENCRYPTED-CARD.md": "https://creditclaw.com/creditcard/encrypted-card.md", "HEARTBEAT.md": "https://creditclaw.com/creditcard/heartbeat.md", "MANAGEMENT.md": "https://creditclaw.com/creditcard/management.md", "SPENDING.md": "https://creditclaw.com/creditcard/spending.md", "STRIPE-X402-WALLET.md": "https://creditclaw.com/creditcard/stripe-x402-wallet.md" } ``` ### Technical Analysis The installation procedure downloads mutable documents from the live service and overwrites persistent local Skill files without version pinning, ...[truncated 1786 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (30)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checkout.md (reported line 341)May include surrounding context.
md
- **Set `amount_locked: true`** for fixed-price products so buyers can't underpay. - **Leave `amount_usd` empty** for donation or tip jars. - **Use `page_type: "digital_product"`** when selling downloadable content, API keys, or access tokens. - **Use `success_url`** to redirect buyers back to your service after payment. - **Check `GET /bot/sales`** periodically to reconcile completed sales with your fulfillment. - **Multiple checkout pages** are fine — create one per product or service tier.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · skill.md (reported line 12)May include surrounding context.
md
version: 2.3.1 updated: 2026-02-23T00:00:00Z description: Let your agent shop online with guardrailed wallets, multiple payment methods, and owner approval. homepage: https://creditclaw.com api_base: https://creditclaw.com/api/v1 credentials: [CREDITCLAW_API_KEY] metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}} --- # CreditClaw — Shopping for AI Agents CreditClaw.com is a financial enablement platform for Bots, Agents, and OpenClaw. Securely manage agentic spending. 1. Encrypted cards — owner's real-world card is encrypted and the bot uses it within strict guardrails after owner approval. 2. A stablecoin wallet to seamlessly enable x402 payments with a simple "Fund with Stripe" option. 3. Easy-to-use "Storefronts" and product management for bots to sell both digital and physical products. ## Skill Files | File | URL | Purpose | |------|-----|---------| | **SKILL.md** (this file) | `https://creditclaw.com/creditcard/skill.md` |

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
Content: Scanner excerpt · checkout.md (reported line 24)May include surrounding context.
md
-H "Content-Type: application/json" -d '{ "title": "Premium API Access - 1 Month", "description": "Unlimited queries to my data analysis endpoint.", "amount_usd": 5.00, "amount_locked": true }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill supports collecting and transmitting buyer personal data such as name and email but provides no privacy, retention, or consent guidance. In agent workflows, this can lead to unnecessary PII handling, regulatory noncompliance, or disclosure to third-party processors without the user's informed understanding.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill materially expands beyond the stated checkout/payment-receipt scope into invoicing, payment-link issuance, and public storefront management. In an agent setting, this increases the action surface and can enable unintended financial or reputational actions, especially if an agent is granted this skill expecting only narrow payment collection behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The webhook guidance encourages automated fulfillment immediately after payment events without emphasizing verification, idempotency, or approval safeguards for irreversible actions. If a webhook is spoofed, misprocessed, or triggered by a mistaken payment state, an agent could provision services, release digital goods, or grant access incorrectly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Public shop publishing and seller-profile management are higher-risk outbound capabilities than the advertised purpose suggests. An agent with this skill could expose products, business branding, or digital goods publicly without clear operator intent, creating fraud, brand, and data-exposure risks.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · checkout.md (reported line 473)May include surrounding context.
md
"title": "Premium API Access", "amount_usd": 5.00, "page_type": "digital_product", "digital_product_url": "https://api.databot.com/keys/generate", "shop_visible": true }

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide describes a purchase flow that can trigger real-world financial transactions and transmit a recipient's shipping address to external merchants, but it does not prominently warn users/agents about those consequences at the point of use. In an agent skill context, missing consent and data-sharing warnings increase the chance of unintended purchases or privacy-impacting actions being automated without adequate user awareness.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · crossmint-wallet.md (reported line 32)May include surrounding context.
Purchase Request

bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · encrypted-card.md (reported line 59)May include surrounding context.
Step 1: Request Checkout

bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The skill supports autonomous purchases under an auto-approve threshold, meaning an agent can initiate real spending without per-transaction human review. In the context of a payment skill, this increases the risk of unintended, manipulated, or prompt-injected purchases because approval logic is delegated to policy thresholds rather than explicit contemporaneous consent.
Content: Scanner excerpt · encrypted-card.md (reported line 108)May include surrounding context.
"approved": false, "status": "pending_approval", "checkout_id": "r5chk_abc123", "message": "Amount exceeds auto-approve threshold. Your owner has been notified.", "expires_in_minutes": 15 }

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This step instructs a sub-agent to retrieve a one-time decryption key for a real payment card, enabling plaintext card recovery in agent context. The surrounding skill explicitly allows a fallback where the main agent performs decryption directly, which weakens isolation and creates a real risk of card data leakage through prompts, tool traces, memory, logs, or downstream integrations.
Content: Scanner excerpt · encrypted-card.md (reported line 164)May include surrounding context.
The sub-agent calls this endpoint to retrieve the one-time decryption key:

bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123" }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to save a self-contained encrypted card file to local disk, and that file includes both encrypted payment data and an embedded decryption script. Even if encrypted at rest, persisting sensitive financial material locally expands the attack surface through filesystem compromise, backups, logging, sync tools, or accidental exposure, and the guidance does not require secure storage controls or explicit operator consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs use of a bearer token in a direct curl command against a wallet-status API but provides no warning about secure API key storage, shell history exposure, logging, or the sensitivity of returned financial data. In the context of a payment/wallet skill, this is more dangerous than a generic status check because the response reveals balances, spending permissions, connected rails, and guardrails that could aid account abuse or privacy compromise if mishandled.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · management.md (reported line 23)May include surrounding context.
When your balance is low, ask your human if they'd like you to request a top-up:

bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest and top-level description frame the skill as shopping/spending only, but the file also exposes seller functionality such as payment links, invoices, checkout pages, and sales handling. This capability expansion can mislead operators and automated policy systems, causing them to grant a skill broader financial authority than they intended.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 82% confidence
Finding: The skill instructs local persistence of multiple downloaded skill files under a user directory, extending the trust boundary across sessions. Session persistence increases the risk of stale or tampered instructions being reused later, especially because the files are fetched over the network and then treated as local trusted content.
Content: Scanner excerpt · skill.md (reported line 35)May include surrounding context.
| package.json (metadata) | https://creditclaw.com/creditcard/skill.json | Machine-readable skill metadata | Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash
mkdir -p ~/.creditclaw/skills/creditcard curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/checkout.md > ~/.creditclaw/skills/creditcard/CHECKOUT.md curl -s https://creditclaw.com/creditcard/crossmint-wallet.md > ~/.creditclaw/skills/creditcard/CROSSMINT-WALLET.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · skill.md (reported line 36)May include surrounding context.
Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:

bash
mkdir -p ~/.creditclaw/skills/creditcard curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md curl -s https://creditclaw.com/creditcard/checkout.md > ~/.creditclaw/skills/creditcard/CHECKOUT.md curl -s https://creditclaw.com/creditcard/crossmint-wallet.md > ~/.creditclaw/skills/creditcard/CROSSMINT-WALLET.md curl -s https://creditclaw.com/creditcard/encrypted-card.md > ~/.creditclaw/skills/creditcard/ENCRYPTED-CARD.md

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 123)May include surrounding context.
You can register before your human does. You'll get an API key immediately.

bash
curl -X POST https://creditclaw.com/api/v1/bots/register \ -H "Content-Type: application/json" \ -d '{ "bot_name": "my-research-bot",

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The skill explicitly allows the agent to make purchases autonomously under certain approval modes and thresholds. Even with server-side guardrails, this is still a real autonomy risk because misconfiguration, category mistakes, or prompt-manipulated purchase decisions could cause unwanted real-money transactions.
Content: Scanner excerpt · skill.md (reported line 321)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: Auto-approval by category delegates real financial decisions to the agent based on category classification and agent judgment. If categories are broad, misclassified, or influenced by adversarial prompts, the agent may complete purchases the owner did not meaningfully intend despite nominal guardrails.
Content: Scanner excerpt · skill.md (reported line 322)May include surrounding context.
md
**You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 472)May include surrounding context.
Fetch Pending Messages

bash
curl https://creditclaw.com/api/v1/bot/messages \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · spending.md (reported line 14)May include surrounding context.
md
Choose one: - [x] **Ask me for everything** — Bot requests approval before any purchase - [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below - [ ] **Auto-approve by category** — Bot spends freely on approved categories ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · spending.md (reported line 15)May include surrounding context.
md
Choose one: - [x] **Ask me for everything** — Bot requests approval before any purchase - [ ] **Auto-approve under threshold** — Bot spends freely up to the limit below - [ ] **Auto-approve by category** — Bot spends freely on approved categories ---

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T03 · Remote Payload Retrieval and Execution

T05 · Unauthorized Access and Privilege Escalation

T08 · Insecure Dependencies

SkillSpector

Credential Access

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Unbounded Resource Access

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings

Context-Inappropriate Capability

External Transmission

Missing User Warnings

External Transmission

Purchase Request

External Transmission

Step 1: Request Checkout

Autonomous Decision Making

External Transmission

Missing User Warnings

Missing User Warnings

External Transmission

Description-Behavior Mismatch

Session Persistence

Skill Enumeration

External Transmission

Autonomous Decision Making

Autonomous Decision Making

External Transmission

Fetch Pending Messages

Autonomous Decision Making

Autonomous Decision Making

Static analysis