← Back to Scanner

agent-credit Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower
Source:
SHA-256:

agent-credit is an AI agent skill, created by aaronjmars and published at aaronjmars/agent-credit. ClawSecure audited agent-credit across 13 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 75/100 (Medium Risk). The 4 findings concentrate in Policy Violation, Command Injection and Permissions Manifest, including Pipeline downloads data from the network and executes it: `curl -L... and Potentially dangerous code pattern detected: curl.*\|.*sh. 2 were rated high or critical severity.

Is agent-credit safe?

ClawSecure audited agent-credit and assigned a security score of 75/100 (Medium Risk), identifying 4 findings across Policy Violation and Command Injection. Review the findings below before installing.

What did ClawSecure find in agent-credit?

ClawSecure identified 4 findings in agent-credit, concentrated in Policy Violation, Command Injection and Permissions Manifest. 2 were rated high or critical severity. The most severe include Pipeline downloads data from the network and executes it: `curl -L... and Potentially dangerous code pattern detected: curl.*\|.*sh.

How was agent-credit audited?

ClawSecure ran agent-credit through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 13 files from aaronjmars/agent-credit.

What does a score of 75 mean?

ClawSecure assigned agent-credit a security score of 75/100, placing it in the Medium Risk range. This reflects 4 findings led by Policy Violation that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for agent-credit

ClawSecure detected 4 security findings in agent-credit, spanning Policy Violation, Command Injection, Permissions Manifest and Code Injection.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for agent-credit

Resolve policy violations
agent-credit trips ClawSecure policy checks. Review each flagged pattern against your security policy and remediate or document an accepted exception before production use.
Harden command execution
agent-credit constructs or runs system commands. Validate that commands are built only from trusted inputs, never pass user-controlled strings directly to a shell, and restrict execution to an allow-list of expected commands.
Add a config.json permissions manifest
A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.
Eliminate dynamic code execution
agent-credit evaluates code at runtime (for example eval or dynamic exec). Remove dynamic evaluation of untrusted input, and where code generation is unavoidable, sandbox it and validate every input.

Related Security Research

OWASP ASI Top 10 Explained: The Complete Guide to AI Agent Security Standards→Understanding Our 3-Layer Audit Protocol→Why Generic Scanners Fail at AI Agent Security→

Related AI Agent Security Audits

lossless-clawScore 85/100GitNexusScore 75/100MiroFishScore 80/100antigravity-awesome-skillsScore 75/100snipara-mcpScore 85/100

Scanned on June 7, 2026. agent-credit is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan