Rei-Clawd

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:32 AM UTC
• Version: 1.0.3

Overview

The skill performs the Rei setup it advertises, but it handles API keys and Clawdbot configuration in ways users should review carefully before installing.

Review this before installing if your Clawdbot config contains real provider credentials. Avoid pasting API keys into chat or command history; use a safer secret input method, verify ~/.clawdbot/clawdbot.json and its .bak file are permission-restricted, and expect the setup script to restart the gateway immediately.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:58

Finding

Configuration Replacement May Weaken Permissions on Stored Credentials

Content

View full analysis

"${CONFIG_FILE}.tmp" && mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE" # Add rei to model allowlist so switching works jq '.agents.defaults.models["rei/rei-qwen3-coder"] = {"alias": "rei"}' "$CONFIG_FILE" > "${CONFIG_FILE}.tmp" && mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE" ``` ### Technical Analysis The shell creates `${CONFIG_FILE}.tmp` using the process's current `umask`. The script neither explicitly restricts the temporary file to mode `0600` nor preserves the original configuration file's permissions and ownership. Under a common `022` umask, the temporary file may be created with mode `0644`. The temporary file contains the Rei API key and may also contain credentials for other configured providers. The subsequent `mv` makes this newly created file the permanent `clawdbot.json`, potentially replacing a previously restricted configuration with a world-readable file. The temporary path is also predictable. Although the script writes through shell redirection and does not itself run with elevated privileges, a predictable path provides weaker protection against local filesystem interference than a securely created temporary file. ### Attack Path 1. A victim has a Clawdbot configuration containing provider credentials and runs `scripts/setup.sh`. 2. The victim's environment uses a permissive umask, such as `022`. 3. Shell redirection creates `~/.clawdbot/clawdbot.json.tmp` with permissions derived from that umask. 4. `jq` writes the full configuration, including API keys, to the temporary file. 5. `mv` replaces the original configuration with the newly created file without restoring the original restrictive permissions. 6. An ...[truncated 769 chars]

Remediation

View remediation

"$TMP_FILE" jq empty "$TMP_FILE" chmod 600 "$TMP_FILE" mv "$TMP_FILE" "$CONFIG_FILE" trap - EXIT ``` Where portability permits, also preserve the original owner and restrictive mode rather than assuming `0600`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:3

Finding

API Key May Be Exposed Through Command Arguments and Echoed Prompt Input

Content

View full analysis

set -e API_KEY="${1:-}" CONFIG_FILE="${HOME}/.clawdbot/clawdbot.json" if [[ -z "$API_KEY" ]]; then echo "Usage: $0 " echo "" read -p "Enter your Rei API key: " API_KEY if [[ -z "$API_KEY" ]]; then echo "Error: API key required" exit 1 fi fi ``` ### Technical Analysis The documented setup procedure encourages users to provide the API key as a command-line argument. Command arguments can be retained in shell history and may be exposed through process inspection, audit systems, terminal recording, automation logs, or agent execution transcripts. If the argument is omitted, the fallback uses `read -p` without the silent `-s` option. Consequently, the API key is visibly echoed while the user types it. This can expose the credential to shoulder surfing, screen sharing, terminal capture, or session recording. The script stores the key in a shell variable, which is necessary for its immediate operation, but it does not provide a protected input mechanism or warn users about the risks of supplying secrets through command arguments. ### Attack Path #### Command-argument exposure 1. A user follows `SKILL.md` and runs the setup script with the real API key as its first argument. 2. The command is recorded in shell history, an agent transcript, CI logs, terminal telemetry, or another command-execution record. 3. Alternatively, a sufficiently privileged local observer inspects process arguments while the script is running. 4. An attacker who can access one of these records extracts the API key. 5. The attacker uses the key against the Rei endpoi ...[truncated 870 chars]

Remediation

View remediation

/dev/tty if [[ -z "$API_KEY" ]]; then echo "Error: API key required" >&2 exit 1 fi fi ``` For unattended operation, accept a path to a permission-restricted secret file rather than exposing the key in the process argument list. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description says this skill is for setting up Rei Qwen3 Coder as a model provider and troubleshooting setup-related endpoint issues. The supplied code does not perform setup or provider configuration; instead, it undoes a previous setup by copying a backup config back into place and restarting the gateway. That is a materially different primary purpose from setup/configuration, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description frames the skill as configuring Rei Qwen3 Coder and troubleshooting Rei-related access issues. The supplied code does include selecting the Rei model, but it also supports switching to an unrelated provider/model (Anthropic Opus). That makes the primary behavior a general model-switching utility, not solely Rei setup. This is a material mismatch because the code exposes an undeclared capability affecting a different model/provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly tells users to send an API key in chat to an agent, which can expose credentials in conversation logs, telemetry, screenshots, prompt history, or downstream tool traces. In an agent environment, secrets provided in natural-language chat may also be accessible to other tools or components, making accidental disclosure and reuse more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script prompts for an API key and then embeds it directly into the persistent Clawdbot JSON config without clearly warning the user that the secret will be stored on disk in plaintext. In this skill context, storing provider credentials is functionally expected, but the lack of explicit disclosure and secure-handling guidance increases the risk of accidental secret exposure via backups, local compromise, or overly permissive file permissions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 28)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
  echo "Error: jq is required but not installed."
  echo "Install with: sudo dnf install jq (Fedora) or brew install jq (macOS)"
  exit 1
fi

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script modifies the user's existing configuration and restarts the Clawdbot gateway immediately, without any confirmation or dry-run step. In a setup skill, automated config changes are expected, but doing so silently can disrupt running sessions, overwrite intended settings, or cause unintended service state changes that the user did not approve.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.