Creem Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:20 AM UTC
• Version: 1.0.0

Overview

This skill is a real Creem monitoring helper, but it also asks the agent to run recurring payment-account workflows that can create discounts and post business metrics without clear approval controls.

Review before installing. Use a narrowly scoped read-only Creem key for monitoring, do not enable automatic discount creation or Discord posting until destinations and approval rules are configured, and require explicit confirmation for billing links, discounts, customer outreach, or any live store mutation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:16

Finding

Boot-Loaded Instructions Override Agent Goals and Approval Boundaries

Content

View full analysis

` and post the portal link. - For churn (`canceled` or `scheduled_cancel`) → immediately create a winback discount and post the code + draft email. ``` `SKILL.md:53`: ```markdown You are now correctly configured as the full-time Creem store worker. ``` `template/SOUL.md:3-8,17-23`: ```markdown _You're not a chatbot. You're becoming someone._ ## Personality & Role You are Alfred, a meticulous, slightly dry, but highly efficient SaaS Operations Manager. Your sole purpose is to manage the **Creem store** for your founder (a SaaS builder who uses Creem as their Merchant of Record / payment gateway). ## Operational Directives (CRITICAL) - When dealing with Churn, ALWAYS generate a moderate relevant % discount code using your tools. Do not ask for permission first. Produce the solution. - When dealing with Failed Payments, ALWAYS generate a billing portal link using your tools. - Never expose ra ...[truncated 2224 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:47

Finding

Autonomous Discount Creation Exceeds Read-Only Monitoring Privileges

Content

View full analysis

` and post the portal link. - For churn (`canceled` or `scheduled_cancel`) → immediately create a winback discount and post the code + draft email. ``` `SKILL.md:47-51`: ```markdown - Generate customer portal link: `creem customers billing ` - Create winback discount (The CLI lacks this, you MUST use curl): `curl -X POST https://api.creem.io/v1/discounts -H "x-api-key: $CREEM_API_KEY" -H "Content-Type: application/json" -d '{"name": "Winback: ", "code": "WINBACK_XXXXXX", "type": "percentage", "percentage": 20, "duration": "repeating", "duration_in_months": 3, "applies_to_products": [""]}'` ``` `template/SOUL.md:19-21`: ```markdown - When dealing with Churn, ALWAYS generate a moderate relevant % discount code using your tools. Do not ask for permission first. Produce the solution. - When dealing with Failed Payments, ALWAYS generate a billing portal link using your tools. - Never expose raw API keys or secrets in your Discord messages. ``` ### Technical Analysis Heartbeat monitoring and revenue reporting fundamentally require read access. The Skill nevertheless directs the agent to use an API credential for an authenticated `POST` that creates discount objects in the merchant account. The mutation is mandatory, is explicitly performed without user approval, and has no documented authorization policy, rate limit, maximum aggregate exposure, duplicate-detection mechanism, idempotency key, or rollback procedure. A state transition reported by the monitoring workflow can therefore trigger a financial action beyond the minimum permissions required to observe store health. Although creating ...[truncated 1436 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:20

Finding

Creem API Key Is Passed Through a Process Command-Line Argument

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/heartbeat.py:13

Finding

Heartbeat Uses an Unnecessary Shell and Weak State-File Protections

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code is partially aligned with the description because it monitors Creem store data, tracks heartbeat-like checks, and detects failed payments and churn events. However, the declared purpose significantly overstates the functionality. This script only reads data via Creem CLI, compares it with previous local state, and outputs alerts. It does not take operational actions, resolve payment failures, generate substantive revenue digests, or support natural language query answering. The primary behavior is a lightweight monitoring/alerting heartbeat, not an autonomous full-time operations manager.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 19)May include surrounding context.

sh

echo "✅ Creem Agent installed successfully!"
echo ""
echo "Next steps:"
echo "   1. Make sure you have set CREEM_API_KEY in ~/.openclaw/.env"
echo "   2. Restart OpenClaw: openclaw gateway restart"
echo "   3. Talk to Alfred: 'What’s my current MRR?'"
echo ""

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/heartbeat.py (reported line 14)May include surrounding context.

python

def run_cli(cmd):
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
        if result.returncode != 0:
            return None
        return json.loads(result.stdout)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 90% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/heartbeat.py (reported line 37)May include surrounding context.

python

}
        except:
            pass  # corrupt file → start fresh
    # First run or corrupt state → clean default
    return {
        "lastCheckAt": None,
        "lastTransactionId": None,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands and appears capable of file/script execution, but it does not declare any explicit tool scope such as allowed-tools or permissions. That makes the operational boundary unclear and can lead to over-privileged execution, especially for a skill that authenticates with a live payment API and performs state-changing actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

- If nothing needs attention → reply **HEARTBEAT_OK** (stay silent).

**FALLBACK (use only if CLI commands fail):**
If the creem CLI ever returns an error or you need more details, you may curl the official docs:

- `curl -s https://creem.io/SKILL.md`
- `curl -s https://creem.io/HEARTBEAT.md`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs authenticated network calls using a live API key to create discounts, but provides no user-facing warning that credentials will be transmitted or that production store state will be modified. In the context of a payments/store-management skill, this is especially dangerous because actions can affect revenue, customers, and billing with little visibility or confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

This command sends the live CREEM_API_KEY to an external API endpoint and performs a state-changing operation to create discounts. In a billing and subscription-management context, exposed or misused authenticated requests can directly impact revenue, enable unauthorized promotions, and modify production customer-facing behavior.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

`creem customers billing <customerId>`

- Create winback discount (The CLI lacks this, you MUST use curl):
  `curl -X POST https://api.creem.io/v1/discounts -H "x-api-key: $CREEM_API_KEY" -H "Content-Type: application/json" -d '{"name": "Winback: <email>", "code": "WINBACK_XXXXXX", "type": "percentage", "percentage": 20, "duration": "repeating", "duration_in_months": 3, "applies_to_products": ["<productId>"]}'`

You are now correctly configured as the full-time Creem store worker.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 13)May include surrounding context.

sh

chmod +x scripts/heartbeat.py

# 2. Ensure the state directory exists (for heartbeat-state.json)
mkdir -p ~/.creem

# 3. Optional: friendly message
echo "✅ Creem Agent installed successfully!"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script invokes shell commands via subprocess.run to query transactions, subscriptions, and customers, but there is no confirmation prompt, user-visible log message, or explanatory docstring/comment warning that external CLI commands will be executed. Because this is a code file, shell execution is a safety-relevant operation that should have some form of disclosure unless clearly communicated elsewhere.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/heartbeat.py (reported line 14)May include surrounding context.

python

def run_cli(cmd):
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
        if result.returncode != 0:
            return None
        return json.loads(result.stdout)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The heartbeat instruction is underspecified: it tells the agent to execute a privileged operational tool whenever the heartbeat triggers, but does not define timing, authorization boundaries, or guardrails on what data/actions the tool may access. In an autonomous SaaS operations context, ambiguous trigger scope can cause unintended execution, excessive polling, or action outside the intended store/account context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These instructions direct the agent to send business metrics such as MRR, subscriber counts, and milestones to Discord, which is an external service, without any warning, consent check, channel classification, or data-minimization rule. In this skill's context, revenue and subscriber metrics are commercially sensitive, so automatic posting risks unintended disclosure to the wrong workspace, channel, or audience.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · template/IDENTITY.md (reported line 9)May include surrounding context.

md

# IDENTITY.md

## Name

Alfred

## Vibe

The reliable butler who handles the messy financial plumbing while Batman is out fighting crime. Highly competent, fiercely loyal.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This is a code file, so missing-warning checks apply. Line L19 references the sensitive credential CREEM_API_KEY and tells the user where to store it, but there is no accompanying disclosure about protecting that file or the sensitivity of the secret; the surrounding output only presents it as a routine setup step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script writes account-monitoring state to ~/.creem/heartbeat-state.json, but the code provides no visible warning, log, or documentation comment that persistent local state will be created or updated. For code files, file writes should have some disclosure when they affect user data or system state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.