buy-safely

This repository accompanies the article "Your agent is calling, and it wants your credit card number."

It contains two OpenClaw skills built during the investigation. Neither is published to ClawHub. One works but isn't safe. The other would be safer but depends on infrastructure that doesn't exist yet.

The investigation

The buy-anything skill on ClawHub asked users to type their credit card number into chat, passed it through the LLM provider's servers, and saved it to the agent's memory file for future purchases. It was removed from ClawHub after Snyk flagged it.

We tried to build a safer alternative. Then we tried to break it. Then we looked at what the payment industry was building instead. The article traces that path and argues about who should control agent commerce infrastructure.

The skills

buy-fast — what we built

Automates checkout via accelerated payment flows (Stripe Link, PayPal Fastlane, Shop Pay). The agent enters the user's email, the payment provider sends an OTP, the user relays the code, the provider handles the card. Card data never enters the agent's context.

Status: built, red-teamed, deliberately not shipped. Browser automation of checkout pages creates its own attack surface — prompt injection via hidden DOM content, the agent as an unreliable narrator of what's on the page, cross-context memory extraction. The skill README documents these and the article explains why they matter.

buy-safely — what it would take

Uses wallet-issued single-use virtual cards with out-of-band user approval and page snapshots as risk signals. The agent never sees card data — not even the virtual card number, which flows through a side channel that bypasses the LLM's context. The page snapshot feeds fraud models at the wallet provider, and the agent stops if it detects hidden instructions in the DOM.

Status: speculative. The wallet and page_snapshot tools do not exist. No consumer wallet exposes virtual card minting to agents. No agent platform supports credential side channels. The skill is a spec for the infrastructure the article argues needs to be built.

Repository structure

buy-safely/
├── skills/
│   ├── buy-fast/
│   │   ├── SKILL.md           ← skill prompt (what the agent executes)
│   │   ├── README.md          ← docs, security model, known limitations
│   │   └── _meta.json         ← ClawHub metadata
│   └── buy-safely/
│       ├── SKILL.md           ← skill prompt (with hypothetical tool specs)
│       ├── README.md          ← docs, security model, what would need to exist
│       └── _meta.json         ← ClawHub metadata
└── README.md                  ← this file

The argument

The article makes a structural argument: the payment industry's centralized protocols (Visa TAP, Mastercard Agent Pay, Stripe ACP, Google AP2) solve the security problems but require agent registration, merchant integration, and gatekeeper approval at every level. Open-source agents get locked out. Independent merchants can't afford the upgrade. Agent commerce becomes a permission system.

The alternative: institutional risk absorption over open card rails. A consumer wallet mints scoped virtual cards, absorbs the residual risk the technology can't eliminate, and builds fraud models over time. The merchant changes nothing — card numbers are the universal interface. The agent stays open — any framework, any model.

Neither skill solves the problem. Together they demonstrate what exists, what's missing, and where the bet needs to be made.