asgcard Security Report — Trusted | ClawSafe

8 /100

asgcard

Virtual MasterCards for AI agents — crypto payments via x402 protocol on Stellar blockchain

ASG Card is a legitimate virtual MasterCard payment infrastructure skill for AI agents built on x402/Stellar. All pre-scan IOCs are benign false positives in a genuine payment product.

Skill Nameasgcard

Duration95.5s

Enginepi

✓

Safe to install

Approve for use. No malicious behavior detected. The skill correctly handles cryptographic credentials, on-chain payments, and card data per its documented purpose.

Findings 4 items

Severity	Finding	Location
Low	CLI filesystem WRITE not declared in SKILL.md Doc Mismatch The CLI writes ~/.asgcard/config.json for wallet key persistence. SKILL.md declares only env ASG_CARD_WALLET_SECRET but not the config file write. This is necessary functionality but not documented. `writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 0o600 });` → Add to SKILL.md metadata under 'requires': 'bins: ["node"]' and document ~/.asgcard/config.json as the credential store location.	`cli/src/index.ts:53`
Low	External service credentials in HTTP requests Sensitive Access FACILITATOR_API_KEY and FOURPAYMENTS_API_TOKEN are sent to external services (facilitator and 4payments.io) via Bearer auth. This is necessary for the payment flow but worth noting. Authorization: `Bearer ${this.apiKey}` → This is standard for payment infrastructure. Ensure FACILITATOR_URL is a trusted endpoint.	`api/src/services/facilitatorClient.ts:79`
Info	False positive: pre-scan base64_cmd IOCs are benign Doc Mismatch The pre-scan flagged Buffer.from(..., 'base64') as CRITICAL obfuscation at 5 locations. All instances are legitimate: decoding CARD_DETAILS_KEY (32-byte AES key), decoding Stellar wallet signatures, and parsing x402 payment headers. No eval() or shell execution from base64. `Buffer.from(env.CARD_DETAILS_KEY, "base64")` → No action needed. Pre-scan heuristic produced false positives for standard cryptographic base64 decoding.	`api/src/config/env.ts:99`
Info	False positive: pre-scan hardcoded IP is SVG path data Doc Mismatch Pre-scan flagged '5.92.42.36' at web/src/main.ts:175 as a hardcoded IP. This is actually part of the GitHub SVG logo path data (d attribute), not an IP address. False positive. `<path d="M12 .297c-6.63 0-12 5.373..."` → No action needed.	`web/src/main.ts:175`

Resource	Declared	Inferred	Status	Evidence
Shell	`NONE`	`NONE`	—	No shell execution found in codebase
Filesystem	`NONE`	`WRITE`	✓ Aligned	cli/src/index.ts:53 — config.json written to ~/.asgcard/
Network	`READ`	`READ`	✓ Aligned	External calls to Stellar Horizon, facilitator, 4payments.io — all documented vi…
Environment	`READ`	`READ`	✓ Aligned	ASG_CARD_WALLET_SECRET, FOURPAYMENTS_API_KEY — all used for payment operations o…
Skill Invoke	`NONE`	`NONE`	—	No skill self-invocation or recursion found
Clipboard	`NONE`	`NONE`	—	web/src/main.ts: copy button uses Clipboard API — documented UI feature
Browser	`NONE`	`NONE`	—	Static web frontend only; no headless browser automation
Database	`NONE`	`WRITE`	✓ Aligned	Internal PostgreSQL/in-memory DB for card state — server-side, not exposed to ag…

5 Critical 1 High 101 findings

🔒