Rei-Clawd

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:32 AM UTC
• Version: 1.0.3

Overview

The skill performs the Rei setup it advertises, but it handles API keys and Clawdbot configuration in ways users should review carefully before installing.

Review this before installing if your Clawdbot config contains real provider credentials. Avoid pasting API keys into chat or command history; use a safer secret input method, verify ~/.clawdbot/clawdbot.json and its .bak file are permission-restricted, and expect the setup script to restart the gateway immediately.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:58
• Finding: Configuration Replacement May Weaken Permissions on Stored Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 58–62 **Vulnerability Type**: Unsafe temporary-file creation and failure to preserve sensitive-file permissions **Risk Level**: Medium ### Vulnerable Code ```bash # Add rei provider jq --argjson rei "$REI_PROVIDER" '.models.providers.rei = $rei' "$CONFIG_FILE" > "${CONFIG_FILE}.tmp" && mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE" # Add rei to model allowlist so switching works jq '.agents.defaults.models["rei/rei-qwen3-coder"] = {"alias": "rei"}' "$CONFIG_FILE" > "${CONFIG_FILE}.tmp" && mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE" ``` ### Technical Analysis The shell creates `${CONFIG_FILE}.tmp` using the process's current `umask`. The script neither explicitly restricts the temporary file to mode `0600` nor preserves the original configuration file's permissions and ownership. Under a common `022` umask, the temporary file may be created with mode `0644`. The temporary file contains the Rei API key and may also contain credentials for other configured providers. The subsequent `mv` makes this newly created file the permanent `clawdbot.json`, potentially replacing a previously restricted configuration with a world-readable file. The temporary path is also predictable. Although the script writes through shell redirection and does not itself run with elevated privileges, a predictable path provides weaker protection against local filesystem interference than a securely created temporary file. ### Attack Path 1. A victim has a Clawdbot configuration containing provider credentials and runs `scripts/setup.sh`. 2. The victim's environment uses a permissive umask, such as `022`. 3. Shell redirection creates `~/.clawdbot/clawdbot.json.tmp` with permissions derived from that umask. 4. `jq` writes the full configuration, including API keys, to the temporary file. 5. `mv` replaces the original configuration with the newly created file without restoring the original restrictive permissions. 6. An ...[truncated 769 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Preserve the original configuration's ownership and mode when replacing it. - Create temporary files securely with `mktemp` inside the configuration directory. - Set a restrictive umask, such as `umask 077`, before creating files containing credentials. - Explicitly apply mode `0600` to the temporary and final configuration files. - Install cleanup traps so temporary files are removed on interruption or failure. - Validate the completed JSON before atomically replacing the original file. - Avoid a fixed `.tmp` filename. For example: ```bash umask 077 CONFIG_DIR="$(dirname "$CONFIG_FILE")" TMP_FILE="$(mktemp "${CONFIG_DIR}/clawdbot.json.tmp.XXXXXX")" trap 'rm -f "$TMP_FILE"' EXIT jq --argjson rei "$REI_PROVIDER" \ '.models.providers.rei = $rei | .agents.defaults.models["rei/rei-qwen3-coder"] = {"alias": "rei"}' \ "$CONFIG_FILE" > "$TMP_FILE" jq empty "$TMP_FILE" chmod 600 "$TMP_FILE" mv "$TMP_FILE" "$CONFIG_FILE" trap - EXIT ``` Where portability permits, also preserve the original owner and restrictive mode rather than assuming `0600`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:3
• Finding: API Key May Be Exposed Through Command Arguments and Echoed Prompt Input<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md`, lines 10–14 - `scripts/setup.sh`, lines 3–16 **Vulnerability Type**: Insecure secret input and handling **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```markdown ## Setup via Script ```bash ./skills/rei/scripts/setup.sh YOUR_REI_API_KEY ``` ``` From `scripts/setup.sh`: ```bash # Usage: ./setup.sh <API_KEY> set -e API_KEY="${1:-}" CONFIG_FILE="${HOME}/.clawdbot/clawdbot.json" if [[ -z "$API_KEY" ]]; then echo "Usage: $0 <REI_API_KEY>" echo "" read -p "Enter your Rei API key: " API_KEY if [[ -z "$API_KEY" ]]; then echo "Error: API key required" exit 1 fi fi ``` ### Technical Analysis The documented setup procedure encourages users to provide the API key as a command-line argument. Command arguments can be retained in shell history and may be exposed through process inspection, audit systems, terminal recording, automation logs, or agent execution transcripts. If the argument is omitted, the fallback uses `read -p` without the silent `-s` option. Consequently, the API key is visibly echoed while the user types it. This can expose the credential to shoulder surfing, screen sharing, terminal capture, or session recording. The script stores the key in a shell variable, which is necessary for its immediate operation, but it does not provide a protected input mechanism or warn users about the risks of supplying secrets through command arguments. ### Attack Path #### Command-argument exposure 1. A user follows `SKILL.md` and runs the setup script with the real API key as its first argument. 2. The command is recorded in shell history, an agent transcript, CI logs, terminal telemetry, or another command-execution record. 3. Alternatively, a sufficiently privileged local observer inspects process arguments while the script is running. 4. An attacker who can access one of these records extracts the API key. 5. The attacker uses the key against the Rei endpoi ...[truncated 870 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove documentation that instructs users to place API keys directly in command arguments. - Prompt for the key silently using `read -r -s`. - Read from `/dev/tty` where appropriate so redirected standard input and logs do not accidentally capture the key. - Support a protected secret file or secret-manager integration for automated use. - Ensure secret files are restricted to mode `0600`. - Avoid printing, tracing, or logging the key. - Document that users should rotate any key previously exposed through history or logs. - Consider clearing the in-memory shell variable with `unset API_KEY` after configuration generation. A safer interactive pattern is: ```bash if [[ -z "${API_KEY:-}" ]]; then read -r -s -p "Enter your Rei API key: " API_KEY </dev/tty printf '\n' >/dev/tty if [[ -z "$API_KEY" ]]; then echo "Error: API key required" >&2 exit 1 fi fi ``` For unattended operation, accept a path to a permission-restricted secret file rather than exposing the key in the process argument list. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description says this skill is for setting up Rei Qwen3 Coder as a model provider and troubleshooting setup-related endpoint issues. The supplied code does not perform setup or provider configuration; instead, it undoes a previous setup by copying a backup config back into place and restarting the gateway. That is a materially different primary purpose from setup/configuration, so this is a description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description frames the skill as configuring Rei Qwen3 Coder and troubleshooting Rei-related access issues. The supplied code does include selecting the Rei model, but it also supports switching to an unrelated provider/model (Anthropic Opus). That makes the primary behavior a general model-switching utility, not solely Rei setup. This is a material mismatch because the code exposes an undeclared capability affecting a different model/provider.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly tells users to send an API key in chat to an agent, which can expose credentials in conversation logs, telemetry, screenshots, prompt history, or downstream tool traces. In an agent environment, secrets provided in natural-language chat may also be accessible to other tools or components, making accidental disclosure and reuse more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script prompts for an API key and then embeds it directly into the persistent Clawdbot JSON config without clearly warning the user that the secret will be stored on disk in plaintext. In this skill context, storing provider credentials is functionally expected, but the lack of explicit disclosure and secure-handling guidance increases the risk of accidental secret exposure via backups, local compromise, or overly permissive file permissions.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if ! command -v jq &> /dev/null; then
  echo "Error: jq is required but not installed."
  echo "Install with: sudo dnf install jq (Fedora) or brew install jq (macOS)"
  exit 1
fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script modifies the user's existing configuration and restarts the Clawdbot gateway immediately, without any confirmation or dry-run step. In a setup skill, automated config changes are expected, but doing so silently can disrupt running sessions, overwrite intended settings, or cause unintended service state changes that the user did not approve.

Static analysis

No suspicious patterns detected.