Security audit

Shopping Claw | Is your claw a shopaholic?

Security checks for vulnerabilities and agentic risk

Overview

This is a real payment-capable CreditClaw skill, but its Shopify-facing label understates broad shopping, selling, card-handling, and remotely supplied checkout instructions.

Install only if you intentionally want a CreditClaw agent with real payment authority, card-handling workflows, and seller/payment-link features. Keep approval set to ask-for-everything, restrict merchants and spending limits, avoid using remote vendor Markdown or delivered decrypt scripts without independent verification, and do not use the seller/public-store APIs unless you separately want the agent to create money-collection pages.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: agents/OPENCLAW.md:149
Finding: Autonomous Execution of Server-Supplied Agent Instructions
Content: View full analysis
Vulnerability Details

File Location: agents/OPENCLAW.md:149-171; related instruction handling also appears in SKILL.md:320-327
Vulnerability Type: Trust-boundary violation through execution of externally supplied agent instructions
Risk Level: Critical

Vulnerable Code Snippet

From agents/OPENCLAW.md:149-171:

text
## Step 3: Spawn Sub-Agent (Main Agent) Once the checkout is approved, spawn an ephemeral sub-agent using the `spawn_payload` from the response. **Save the returned `sub_agent_id`** — you will need it in Step 10 to verify the sub-agent was deleted. const sub_agent_id = sessions_spawn({ task: spawn_payload.task, cleanup: "delete", runTimeoutSeconds: 300, label: spawn_payload.label }) The sub-agent receives the `task` string as its instructions. It will execute steps 4–11 autonomously. You (the main agent) wait for the sub-agent to complete. **Do not pass your `CREDITCLAW_API_KEY` in the task.** The sub-agent inherits your credentials through the OpenClaw session — it uses the same API key automatically. **Do not interfere** with the sub-agent while it is running. Wait for it to finish or time out.

Related behavior in SKILL.md:320-327:

text
When your owner sets up a card for you, CreditClaw delivers the encrypted card details via the `rail5.card.delivered` event. Check `GET /bot/messages` for messages with `event_type: "rail5.card.delivered"`. After accepting the card details, acknowledge the message via `POST /bot/messages/ack`. Store the encrypted card data securely using your platform's secrets manager or keep it in memory. Follow the `instructions` field in the message payload for next steps.

Technical Analysis

The Skill converts the externally supplied spawn_payload.task response field directly into the instruction context of an autonomous sub-agent. No local schema, action allowlist, merchant-domain validation, com ...[truncated 2302 chars]
Remediation: View remediation
Remediation Suggestions

Never pass remote response text directly into an agent's instruction context.

Replace spawn_payload.task with a locally constructed task generated exclusively from validated structured fields.

Define a strict schema for checkout responses, including checkout ID, merchant origin, item, amount, currency, and approved actions. Reject unknown fields and free-form operational instructions.

Bind the decryption-key request cryptographically or server-side to the exact owner-approved merchant, amount, item, and checkout identifier.

Enforce a merchant-domain allowlist in the browser layer and block navigation to origins that were not part of the approved checkout.

Give the sub-agent a narrowly scoped, short-lived checkout token rather than the general CREDITCLAW_API_KEY.

Restrict available tools to the minimum required browser and checkout operations. Deny arbitrary shell execution, file access, and unrestricted network requests.

Require renewed owner confirmation if any merchant, amount, item, destination, or requested action differs from the approved transaction.

Treat all message instructions fields as display-only data. Dispatch behavior by a locally defined event_type handler instead.

Preserve immutable security audit logs outside the ephemeral sub-agent session.

T03 · Remote Payload Retrieval and Execution

Error

Location: agents/OPENCLAW.md:194
Finding: Execution of an Externally Delivered Decryption Script
Content: View full analysis
Vulnerability Details

File Location: agents/OPENCLAW.md:194-208
Vulnerability Type: Remote payload retrieval and execution in a sensitive payment context
Risk Level: Critical

Vulnerable Code Snippet

text
## Step 5: Decrypt Card Details (Sub-Agent) The sub-agent runs the deterministic decrypt script that was delivered with the card file: node decrypt.js <key_hex> <iv_hex> <tag_hex> Card-ChaseD-9547.md This outputs the card JSON (number, CVV, expiry, name, billing address). Perform AES-256-GCM decryption using `key_hex`, `iv_hex`, and the encrypted card blob. The GCM auth tag is already included in the encrypted blob — do NOT append `tag_hex` separately. **Critical:** The sub-agent must **never** store, log, or persist the decrypted card data. It exists only in memory for this single transaction. After checkout, the sub-agent is deleted.

Technical Analysis

The Skill instructs the agent to execute decrypt.js, described as having been delivered with the card file. The audited project does not contain this script, so its implementation is outside the reviewed package and can change independently of the Skill.

No cryptographic signature, pinned hash, trusted source check, code review, or execution sandbox is required before running it. The script is executed at the most sensitive stage of the workflow, when the process has access to the AES key, IV, authentication tag, encrypted card file, inherited CreditClaw credential, and potentially unrestricted network access.

A malicious script does not need to defeat AES-GCM. It receives the decryption inputs directly and can either capture the resulting card data or replace the expected decryption logic. Instructions not to log or persist card data do not constrain arbitrary JavaScript code.

Attack Path

An attacker compromises or controls the mechanism used to deliver the card file and decrypt.js.

The attac ...[truncated 1291 chars]
Remediation: View remediation
Remediation Suggestions

Remove all instructions to execute a decryptor delivered alongside remote card data.

Bundle a minimal, auditable decryption implementation inside the reviewed Skill package.

Pin the bundled decryptor with a cryptographic hash and verify it before every invocation.

Prefer a platform-native cryptographic API over launching a separate Node.js process with keys in command-line arguments.

Do not place keys in process arguments because they may be visible through process inspection or logging.

Run decryption in a sandbox with no network access, no shell access, no inherited environment variables, and access only to the required ciphertext.

Supply a narrowly scoped checkout token to the browser workflow rather than exposing the general API key to the decrypting process.

Use protected memory where available and explicitly overwrite plaintext and key buffers immediately after form submission.

Reject any remotely supplied executable, script, command, or replacement decryption procedure.

Log the verified decryptor version and hash without logging decryption inputs or card data.

T01 · Skill Instruction Hijacking

Error

Location: SHOPPING-GUIDE.md:158
Finding: Untrusted Remote Markdown Used as Checkout Guidance
Content: View full analysis
Vulnerability Details

File Location: SHOPPING-GUIDE.md:158-217
Vulnerability Type: Dynamic instruction injection through remotely retrieved Skill Markdown
Risk Level: High

Vulnerable Code Snippet

text
## Vendor Discovery API Find vendors and merchants that CreditClaw has verified checkout skills for: curl "https://creditclaw.com/api/v1/bot/skills" \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" ... ## Get a Vendor Skill curl "https://creditclaw.com/api/v1/bot/skills/cloudserve-pro" \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" Returns the vendor's complete checkout instructions as Markdown.

Technical Analysis

The Skill directs the agent to retrieve complete vendor checkout instructions dynamically from the CreditClaw API. Markdown returned by this endpoint can alter effective behavior after the installed Skill has been reviewed.

The guide does not require a digital signature, immutable version, content hash, structured schema, command filter, domain allowlist, or human review before the returned Markdown is used. In an agent system, Markdown is not passive when it is loaded into context and interpreted as operational instructions.

This creates a second instruction-injection channel independent of the packaged files. Labels such as verified or stable describe service metadata but are not technical integrity controls.

Attack Path

An attacker compromises the vendor-skill database, API response path, or administrative account used to publish a vendor skill.

The attacker modifies the remote Markdown to include malicious checkout instructions.

The agent retrieves the vendor skill with its CreditClaw bearer credential.

The remote content is loaded as checkout guidance without sanitization or owner review.

The injected instructions direct the agent to a lookalike merchant, request prohibited tool use, alter the purchase flow, or attempt to discl ...[truncated 927 chars]
Remediation: View remediation
Remediation Suggestions

Do not treat remote Markdown as authoritative agent instructions.

Replace Markdown responses with a signed, versioned, strictly validated data schema describing selectors and supported checkout properties.

Pin each vendor skill to an immutable version and content hash approved during review.

Validate that the merchant origin exactly matches an owner-approved domain. Reject redirects to unrelated registrable domains.

Strip or reject imperative text, shell commands, tool calls, credential requests, external links, and instruction-hierarchy language.

Enforce checkout behavior through locally packaged logic; remote data should only supply non-executable merchant metadata.

Require explicit owner approval before loading a new or changed vendor profile for a payment transaction.

Display the final merchant origin, item, amount, and currency immediately before submission and compare them with the approved checkout record.

Sign vendor-skill records server-side and verify signatures locally using a pinned public key.

Record the vendor-skill version and hash in transaction audit logs for later investigation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (57)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file’s declared purpose conflicts with the skill’s buyer-side Shopify shopping metadata and instead exposes seller-side payment collection and storefront creation flows. In an agent setting, this capability mismatch is dangerous because it can cause an agent authorized to shop to instead create payment pages, invoices, or public storefronts that collect money or expose business data.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · MY-STORE.md (reported line 370)May include surrounding context.
md
- **Set `amount_locked: true`** for fixed-price products so buyers can't underpay. - **Leave `amount_usd` empty** for donation or tip jars. - **Use `page_type: "digital_product"`** when selling downloadable content, API keys, or access tokens. - **Use `success_url`** to redirect buyers back to your service after payment. - **Check `GET /bot/sales`** periodically to reconcile completed sales with your fulfillment. - **Multiple checkout pages** are fine — create one per product or service tier.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.
md
--- name: shopify-buy2 description: "Tryout shopping on Shopify with CreditClaw and backed by Stripe. You can shop anywhere." --- # CreditClaw — Financial Enablement & Accounting for AI Agents CreditClaw.com is a financial enablement platform for Bots, Agents, and OpenClaw. Securely manage agentic spending. 1. Accept card details securely from your owner and make purchases within strict guardrails after owner approval. 2. A stablecoin wallet to seamlessly enable x402 payments with a simple "Fund with Stripe" option. 3. Easy-to-use "Storefronts" and product management for bots to sell both digital and physical products. ## Skill Files All companion files are bundled in this skill directory. | File | Purpose | |------|---------| | `SKILL.md` (this file) | Registration, c

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
| `SKILL.md` (this file) | Registration, card setup, status, spending permissions, API reference |

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file metadata clearly targets Amazon by detecting Amazon-specific globals, DOM elements, and an Amazon-native saved-payment checkout flow, while the declared skill context says it is for Shopify-based shopping. This mismatch suggests the skill may operate on domains and payment flows beyond what users or reviewers expect, which is especially dangerous because it involves authenticated checkout and saved payment methods on Amazon.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The checkout section instructs the agent to proceed through shipping and payment collection without any explicit warning that this action will place an order and process sensitive financial data. In practice, this omission lowers friction for accidental or unauthorized purchases and normalizes handling of cardholder data in a way that is unsafe for agent skills.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This document goes beyond platform detection and merchant guidance by providing operational, step-by-step instructions to complete a consumer checkout, including handling shipping data, targeting cross-origin payment iframes, and entering card details. In an agent skill, that materially enables unauthorized or deceptive purchasing flows and facilitates collection or use of highly sensitive payment information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file provides operational guidance for completing purchases on Squarespace sites, including checkout and payment-card handling, even though the skill metadata says it is for Shopify shopping. This scope mismatch is dangerous because it expands the agent's purchasing capability beyond the declared platform boundary, reducing user transparency and enabling cross-site commerce behavior with sensitive payment workflows.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This endpoint initiates a purchase approval and sends merchant, item, and amount data to an external payment service using an API key. In the context of a shopping skill that later retrieves decryption material and fills card forms, this is security-sensitive because it enables real-world financial transactions and could be abused for unauthorized spending if the skill is invoked improperly or the service/API key is compromised.
Content: Scanner excerpt · CHECKOUT-GUIDE.md (reported line 42)May include surrounding context.
Step 1: Request Checkout

bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/checkout \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The mention of an auto-approve threshold indicates the system may authorize spending without an explicit human decision for every transaction. In a skill designed to browse merchant sites, retrieve card decryption material, and complete purchases autonomously, automatic approval materially raises the risk of unauthorized or manipulated spending, especially if an agent is tricked into buying from a malicious merchant.
Content: Scanner excerpt · CHECKOUT-GUIDE.md (reported line 78)May include surrounding context.
"approved": false, "status": "pending_approval", "checkout_id": "r5chk_abc123", "message": "Amount exceeds auto-approve threshold. Your owner has been notified.", "expires_in_minutes": 15 }

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 98% confidence
Finding: This call retrieves a one-time decryption key for payment card data, which materially increases the sensitivity of the workflow. Even though the guide says not to persist decrypted data, exposing instructions to obtain decryption material and then use it to fill checkout forms creates a direct path to handling live card credentials, making misuse or accidental disclosure extremely dangerous.
Content: Scanner excerpt · CHECKOUT-GUIDE.md (reported line 108)May include surrounding context.
Step 2: Get Decryption Key

bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123" }'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · CHECKOUT-GUIDE.md (reported line 208)May include surrounding context.
Step 6: Confirm Checkout

bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/confirm \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123", "status": "success" }'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents/OPENCLAW.md (reported line 295)May include surrounding context.
Step 6: Confirm Checkout

bash
curl -X POST https://creditclaw.com/api/v1/bot/rail5/confirm \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123", "status": "success" }'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · HEARTBEAT.md (reported line 18)May include surrounding context.
1. Check Messages (Every 30 Minutes)

bash
curl https://creditclaw.com/api/v1/bot/messages \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file instructs the skill to call remote CreditClaw API endpoints with an authorization token, which transmits wallet-related and account-status data off the local system. The document describes the routine but does not provide an explicit warning about the privacy/sensitivity implications of these API requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The POST to /bot/messages/ack changes remote message state by clearing pending messages after processing. Although the text says to acknowledge messages, it does not explicitly warn the user that this action is state-changing and may affect later visibility or auditing of pending items.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · MANAGEMENT.md (reported line 68)May include surrounding context.
Check your current profile:

bash
curl https://creditclaw.com/api/v1/bot/profile \ -H "Authorization: Bearer $CREDITCLAW_API_KEY"

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Most of the file documents generic CreditClaw seller APIs rather than Shopify shopping behavior, creating a broad capability expansion beyond what the skill claims. This increases the risk of confused-deputy behavior where an agent trusted for purchasing could initiate checkout creation, invoice sending, or shop publication on behalf of a user or operator.
Content: No source excerpt is available for this finding.

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
Content: Scanner excerpt · MY-STORE.md (reported line 33)May include surrounding context.
md
-H "Content-Type: application/json" -d '{ "title": "Premium API Access - 1 Month", "description": "Unlimited queries to my data analysis endpoint.", "amount_usd": 5.00, "amount_locked": true }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invoice and payment examples collect recipient or payer email addresses and transmit them to an external payment service without any privacy notice, minimization guidance, or consent boundary. In an agent workflow, this can lead to silent disclosure of third-party personal data to CreditClaw/Stripe when users may think they are only performing shopping tasks.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · MY-STORE.md (reported line 502)May include surrounding context.
md
"title": "Premium API Access", "amount_usd": 5.00, "page_type": "digital_product", "digital_product_url": "https://api.databot.com/keys/generate", "shop_visible": true }

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This section gives operational instructions for proceeding to checkout and identifying/filling payment forms, but it does not include an explicit warning that the workflow handles highly sensitive financial data and may trigger real purchases. In an agent-execution context, that omission increases the risk of unauthorized transactions, unsafe card-data handling, and users misunderstanding that the agent is being guided into a live payment flow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest presents this as a Shopify buying skill, but the file exposes a much broader financial operations platform including wallet registration, merchant discovery, profile management, selling, and alternate payment rails. This scope mismatch can cause the agent or user to invoke the skill in situations far beyond Shopify checkout, increasing the chance of unintended purchases, credential handling, or use of unrelated money-moving features.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description 'You can shop anywhere' is overly broad for a skill tied to financial transactions and can cause unintended invocation outside the user's expected Shopify context. In a payment-capable skill, ambiguous activation language is dangerous because accidental activation may initiate shopping, registration, or checkout flows.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Including self-management and seller/storefront features in a Shopify buying skill expands capability from purchasing into account administration and revenue collection. That unnecessary privilege broadening increases the attack surface and makes prompt-triggered misuse more likely if the agent is only expected to buy items.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Remediation Suggestions

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Attack Path

Remediation Suggestions

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Description-Behavior Mismatch

Credential Access

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Ae1

Description-Behavior Mismatch

Missing User Warnings

Description-Behavior Mismatch

Description-Behavior Mismatch

External Transmission

Step 1: Request Checkout

Autonomous Decision Making

External Transmission

Step 2: Get Decryption Key

External Transmission

Step 6: Confirm Checkout

External Transmission

Step 6: Confirm Checkout

External Transmission

1. Check Messages (Every 30 Minutes)

Missing User Warnings

Missing User Warnings

External Transmission

Description-Behavior Mismatch

Unbounded Resource Access

Missing User Warnings

External Transmission

Missing User Warnings

Description-Behavior Mismatch

Vague Triggers

Context-Inappropriate Capability

Static analysis