agent-credit Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

agent-credit is an AI agent skill, created by aaronjmars and published at aaronjmars/agent-credit. ClawSecure audited agent-credit across 23 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 53/100 (Warning). The 7 findings concentrate in Data Exfiltration, Code Injection and Command Injection, including Pipeline downloads data from the network and executes it:… and Correlated network → code_execution behavior across…. 4 were rated high or critical severity.

Is agent-credit safe?

ClawSecure audited agent-credit and assigned a security score of 53/100 (Warning), identifying 7 findings across Data Exfiltration and Code Injection. Review the findings below before installing.

What did ClawSecure find in agent-credit?

ClawSecure identified 7 findings in agent-credit, concentrated in Data Exfiltration, Code Injection and Command Injection. 4 were rated high or critical severity. The most severe include Pipeline downloads data from the network and executes it:… and Correlated network → code_execution behavior across….

How was agent-credit audited?

ClawSecure ran agent-credit through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 23 files from aaronjmars/agent-credit.

What does a score of 53 mean?

ClawSecure assigned agent-credit a security score of 53/100, placing it in the Warning range. This is driven by 7 findings led by Data Exfiltration that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for agent-credit

ClawSecure detected 7 security findings in agent-credit, spanning Data Exfiltration, Code Injection, Command Injection and Permissions Manifest.

high · Pipeline downloads data from the network and executes it:…. Data Exfiltration finding detected in SKILL.md:1.
high · Correlated network → code_execution behavior across…. Command Injection finding detected in SKILL.md:74.
high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in README.md.
high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in SKILL.md.
medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
low · Pipeline downloads data from the network and executes it:…. Data Exfiltration finding detected in .github/README.md:1.
info · Missing License Declaration. Policy Violation finding detected in SKILL.md.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for agent-credit

Audit external network connections

agent-credit sends data to external endpoints. Confirm each destination is expected and authorized, and remove any callback that exfiltrates data. ClawSecure monitors for known exfiltration and C2 endpoints.

Eliminate dynamic code execution

agent-credit evaluates code at runtime (for example eval or dynamic exec). Remove dynamic evaluation of untrusted input, and where code generation is unavoidable, sandbox it and validate every input.

Harden command execution

agent-credit constructs or runs system commands. Validate that commands are built only from trusted inputs, never pass user-controlled strings directly to a shell, and restrict execution to an allow-list of expected commands.

Related Security Research

ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→

Related AI Agent Security Audits

agency-agentsScore 45/100 Agent-ReachScore 65/100 mission-controlScore 38/100 ticktickScore 65/100 @openclaw/dashboardScore 45/100

Scanned on October 8, 2026. agent-credit is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan