Securely buy physical products on Amazon.com using owner-funded wallets with spending limits and mandatory purchase approvals.
Security Analysis
high confidenceThe skill's requested credential, endpoints, and runtime instructions align with its stated purpose (placing Amazon orders via CreditClaw) and there are no disproportionate or unrelated permissions or install actions.
Name and description say the skill places Amazon orders using a CreditClaw wallet; the only required credential is CREDITCLAW_API_KEY and all documented endpoints are at creditclaw.com/api/v1 — this is coherent and proportional to the stated purpose.
SKILL.md and companion docs instruct the agent to call CreditClaw API endpoints, poll order status, and optionally save docs to ~/.creditclaw; they do not ask the agent to read unrelated system files, access other credentials, or exfiltrate data to third-party domains. Web searches for ASIN discovery are expected and limited in scope.
The skill is instruction-only with no install spec or remote code downloads. The only file-write guidance is to save skill docs to a user-local ~/.creditclaw path via curl — low-risk and consistent with documentation caching.
Only CREDITCLAW_API_KEY is required and is directly used for Authorization in the documented API calls. There are no unrelated secrets, config paths, or multiple credentials requested.
The skill does not request always:true and does not modify other skills or system-wide settings. It suggests a periodic heartbeat (polling the service) which is appropriate for wallet/status monitoring and is in-scope for its purpose.
Guidance
This skill appears internally consistent, but you should still verify the external service before giving it real money-control credentials. Before installing: (1) confirm creditclaw.com is a legitimate service you trust and review their terms/privacy; (2) provision a limited API key (rotate/revokeable) and start with a small balance or low spending limits to test behavior; (3) ensure your owner (the human who funds the wallet) understands and approves the guardrails and approval settings; and (4) monitor the CreditClaw dashboard and API logs for unexpected activity and be prepared to revoke the API key if you see unexplained requests.
Latest Release
v1.0.5
- Rebranded skill as "creditclaw-amazon" with updated metadata and documentation. - Added comprehensive documentation on shopping via Amazon with guardrailed wallets and owner approval. - Detailed new and existing payment rails, focusing on Card Wallet (USDC-to-fiat) for Amazon purchases. - Expanded security section with stricter guidance on API key handling, new best practices, and defense-in-depth explanations. - Provided step-by-step guides for registration, usage, and approval flows, including alternative “owner-first” onboarding. - Clarified Amazon purchase restrictions and procedures in supporting documentation.
More by @codejika
ShopClaw | Give your claw shopping tasks with strict controls
4 stars
CreditClaw | Give your agent a wallet or credit card
2 stars
CashClaw | Give your agent a wallet or credit card
1 stars
Perplexity Computer Payments | Make payments with Perplexity Computer
0 stars
MasterCard AgentPay | Compatible compatible cards, wallets & payments
0 stars
Authorize.net Agentic Payments - Add agentic cards and wallets to your stack
0 stars
Published by @codejika on ClawHub
