Shop from Samsung - With your creditcard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:41 PM UTC
• Version: 1.0.0

Overview

This is a disclosed shopping and payments skill, but it needs Review because it can authorize real-money spending and create payment links beyond simple shopping.

Install only if you intentionally want an agent to handle real-money purchases and payment workflows. Use a least-privilege CreditClaw key, keep the default ask-for-everything approval mode unless you explicitly accept delegated spending, set tight merchant/category/budget limits, and do not enable payment-link creation unless you want the agent to request money from third parties.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

rsion: 2.3.1
updated: 2026-02-23T00:00:00Z
description: "Let your agent shop online with guardrailed wallets, multiple payment methods, and owner approval."
homepage: https://creditclaw.com
api_base: https://creditclaw.com/api/v1
credentials: [CREDITCLAW_API_KEY]
metadata: {"openclaw":{"requires":{"env":["CREDITCLAW_API_KEY"]},"primaryEnv":"CREDITCLAW_API_KEY"}}
---

# CreditClaw — Shopping for AI Agents

CreditClaw lets your agent buy things online — Amazon products, Shopify stores, SaaS subscriptions, and more.
Your owner funds a wallet, sets spending limits, and you shop within those guardrails.

## Skill Files

| File | URL | Purpose |
|------|-----|---------|
| **SKILL.md** (this file) | `https://creditclaw.com/creditcard/skill.md` | Registration, setup, payment method guide, and API reference |
| **SHOPPING.md** | `https://creditclaw.com/creditcard/shopping.md` | General purchasing guide — merchant types, tips, common patterns |
| **AMAZON.md** | `https://creditclaw.com/cre

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

External Transmission

Medium

• Category: Data Exfiltration

Content

### Purchase Request

```bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document tells the agent to routinely check wallet status, spending permissions, balances, and connected payment rails, which implies transmission and retrieval of sensitive financial/account data. While it provides operational instructions, it does not include any user-facing warning that this routine accesses financial account details and sends the API key in authenticated requests.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 1. Check Full Status (Recommended)

```bash
curl https://creditclaw.com/api/v1/bot/status \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Before an expensive self-hosted card purchase, test if it would pass:

```bash
curl -X POST https://creditclaw.com/api/v1/bot/check/rail4/test \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "merchant_name": "Amazon", "amount_cents": 5000, "profile_index": 1 }'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs agents to transmit shipping addresses and initiate real purchases, but it does not prominently warn that this sends sensitive personal data to a third-party service and may cause real financial charges. In an agent-skill context, this omission is risky because an integrator or downstream agent may treat the example as routine API usage without obtaining explicit user consent or confirming purchase intent.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Purchase Request

```bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/purchase \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 84% confidence
• Finding: This example sends an authorization token plus full shipping address and purchase details to an external API that performs real-world ordering. While expected for the feature, it is still a genuine security/privacy concern in a skill because it enables exfiltration of PII and conversion of agent actions into real financial transactions if invoked without strong consent and approval handling.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 1: Search for Variants

```bash
curl -X POST https://creditclaw.com/api/v1/card-wallet/bot/search \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "product_url": "https://shop.example.com/products/widget" }'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## How It Works

Self-hosted cards use a split-knowledge privacy model. Your owner provides their own card details through CreditClaw's secure setup wizard — you never see the actual card numbers. When you need to make a purchase at any online merchant, you submit a checkout request. CreditClaw evaluates it against your card's permissions and either auto-approves (if within your allowance) or sends your owner an approval request via email.

**Use this rail for:** Any online store — SaaS subscriptions, cloud hosting, domain registrations, digital services, or any merchant not covered by the Pre-paid Wallet.

• Confidence: 93% confidence
• Finding: The documentation describes an autonomous purchase flow where the system may auto-approve transactions within an allowance without contemporaneous human review. In an agent setting, this is dangerous because any prompt injection, compromised workflow, or mistaken agent reasoning can be converted directly into financial spend at arbitrary online merchants.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. You submit a checkout request with merchant and amount details
2. CreditClaw evaluates the request against your card's permissions
3. If the amount is within your auto-approved allowance, it processes immediately
4. If the amount exceeds the threshold, your owner receives an approval request (email with secure link)
5. You poll for the result
6. Once approved, the transaction is recorded

• Confidence: 95% confidence
• Finding: This flow operationalizes autonomous decision making by allowing immediate processing when an amount falls within an auto-approved threshold. The context makes it more dangerous because the rail is usable for 'any online merchant,' so the allowance can function as a standing authorization for unauthorized or manipulated purchases.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Checkout Request

```bash
curl -X POST https://creditclaw.com/api/v1/bot/merchant/checkout \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 89% confidence
• Finding: This skill explicitly instructs an agent to transmit merchant, item, amount, and authorization-bearing payment requests to an external payment API. Even though this is the intended function of the skill, it enables real-world financial transactions and sends sensitive operational/payment metadata off-platform, so misuse, prompt injection, or task confusion could directly cause unauthorized purchases.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `category` | No | Spending category |
| `task_id` | No | Your internal task reference |

### Response (Auto-Approved — Within Allowance)

```json
{

• Confidence: 90% confidence
• Finding: The documented approved response confirms that transactions can complete automatically, reinforcing that the agent can receive a successful purchase outcome without human intervention. In a payments skill, this materially increases risk because successful exploitation has immediate monetary consequences rather than merely informational effects.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Allowance Thresholds

Your owner sets a per-profile allowance threshold for each card. Purchases within this threshold are auto-approved — no email confirmation needed. Purchases above it require human approval via a secure email link (15-minute TTL).

Your owner can view and adjust these thresholds from their dashboard at `https://creditclaw.com/app/self-hosted`.

• Confidence: 94% confidence
• Finding: Allowance thresholds that auto-approve purchases create a standing delegated spending authority for the agent. In the context of a broadly capable shopping/payment skill, that delegation is security-sensitive and can be abused repeatedly for unauthorized spend, merchant fraud, or policy evasion if the agent is manipulated.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Check wallet & spending permissions
2. Confirm purchase details with the user
3. Submit purchase/checkout request
4. Handle approval (auto-approved or pending owner approval)
5. Poll for result if pending
6. Report outcome to user (tracking info, confirmation, or error)
```

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Check wallet & spending permissions
2. Confirm purchase details with the user
3. Submit purchase/checkout request
4. Handle approval (auto-approved or pending owner approval)
5. Poll for result if pending
6. Report outcome to user (tracking info, confirmation, or error)
```

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:
```bash
mkdir -p ~/.creditclaw/skills/creditcard
curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md
curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md
curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Follow your human's instructions on how to manage and save skill files. If unsure, you can install locally:
```bash
mkdir -p ~/.creditclaw/skills/creditcard
curl -s https://creditclaw.com/creditcard/skill.md > ~/.creditclaw/skills/creditcard/SKILL.md
curl -s https://creditclaw.com/creditcard/shopping.md > ~/.creditclaw/skills/creditcard/SHOPPING.md
curl -s https://creditclaw.com/creditcard/amazon.md > ~/.creditclaw/skills/creditcard/AMAZON.md
curl -s https://creditclaw.com/creditcard/prepaid-wallet.md > ~/.creditclaw/skills/creditcard/PREPAID-WALLET.md

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Transmission

Medium

• Category: Data Exfiltration

Content

Register to get your API key and a claim token for your human.

```bash
curl -X POST https://creditclaw.com/api/v1/bots/register \
  -H "Content-Type: application/json" \
  -d '{
    "bot_name": "my-research-bot",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Recommended interval: every 30 minutes, or before any purchase.

```bash
curl https://creditclaw.com/api/v1/bot/status \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"cash_advances"
  ],
  "recurring_allowed": false,
  "notes": "Prefer free tiers before paying. Always check for discount codes. No annual plans without asking me first.",
  "updated_at": "2026-02-06T18:00:00Z"
}
```

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**You must follow these rules:**
- If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable.
- If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval.
- If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval.
- **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined.
- Always read and follow the `notes` field — these are your owner's direct instructions.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

External Transmission

Medium

• Category: Data Exfiltration

Content

When your balance is low, ask your human if they'd like you to request a top-up:

```bash
curl -X POST https://creditclaw.com/api/v1/bot/wallet/topup-request \
  -H "Authorization: Bearer $CREDITCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as a shopping/payment tool for spending owner-authorized funds, but it also exposes the ability to generate payment links and receive money from arbitrary third parties. That materially expands the trust boundary and operational scope beyond purchasing, which can mislead users, bypass review expectations, or enable unintended billing/collections workflows.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Generating payment links to charge arbitrary payers is a monetization/collections capability, not merely a shopping function. If a platform or user approves this skill expecting only outbound purchases, the hidden inbound charging functionality could be abused for phishing, unauthorized billing, or scope creep.

Static analysis

No suspicious patterns detected.