Reah Skill: Agent Card

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.0.3

Overview

This skill is not clearly malicious, but it handles full payment-card data and presents broad purchase examples without enough scoping or control.

Review carefully before installing. Only use this with explicit user approval for each card-key read, avoid putting real access keys in command-line arguments, do not use broad purchase prompts, and treat any decrypted PAN/CVC exposure as sensitive payment-card data requiring strict handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:15
• Finding: Unpinned Executable Installer and Mutable Remote Source<![CDATA[ ## Vulnerability Details **File Location**: `README.md:15-17` **Vulnerability Type**: Supply-chain exposure through unpinned executable tooling and mutable remote content **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/ReahPlatform/skills ``` ### Technical Analysis The installation command invokes `npx skills` without an exact package version and obtains Skill content from a GitHub repository without pinning it to an immutable commit or signed release. Both resolved components can consequently change after this audit: 1. `npx` may retrieve and execute a different version of the `skills` package. 2. The GitHub repository URL may resolve to modified Skill instructions or scripts. This creates unnecessary supply-chain risk for the installation of a small, static Skill bundle. The effective installation payload is not reproducibly bound to the code that was reviewed. ### Attack Path 1. An attacker compromises the resolved npm package, its publisher account, the associated package-distribution path, or the referenced GitHub repository. 2. The attacker publishes altered installer logic or malicious Skill content. 3. A user follows the documented Quick Start command. 4. `npx` retrieves and executes the mutable installer package. 5. The installer retrieves the mutable repository content. 6. Attacker-controlled code may execute with the invoking user's privileges, or modified Skill instructions and scripts may be installed into the agent environment. ### Impact Assessment Successful exploitation could permit code execution under the privileges of the user running the installation command. It could also install altered Skill content that later gains access to Reah access keys or card-related workflows. The finding does not establish that the current package or repository is malicious; the vulnerability is the absence of immutable version and integrity controls. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the npm installer package to an exact, reviewed version. - Pin the GitHub source to a verified commit hash or signed release tag rather than a mutable repository reference. - Publish and verify cryptographic integrity hashes for distributed Skill files. - Prefer a non-executing installation mechanism that copies reviewed local files instead of running remotely resolved package code. - Document the expected package version, source commit, and verification procedure. - Use signed releases and enforce protected publishing workflows for both npm and repository artifacts. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43
• Finding: Access Key Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Locations**: `SKILL.md:43-44`; `get-card-info-example.mjs:34-41` **Vulnerability Type**: Plaintext secret exposure through process arguments **Risk Level**: Medium ### Vulnerable Code `SKILL.md:43-44` documents passing the access key directly on the command line: ```bash node {baseDir}/scripts/get-card-info-example.mjs \ --access-key "<accessKey>" ``` `get-card-info-example.mjs:34-41` parses the plaintext key from the process argument vector: ```js for (let i = 0; i < argv.length; i += 1) { const arg = argv[i]; switch (arg) { case "--access-key": opts.accessKey = argv[++i]; break; case "--timeout-ms": opts.timeoutMs = Number.parseInt(argv[++i], 10); break; ``` ### Technical Analysis Command-line arguments are not an appropriate transport for sensitive credentials. Depending on the host and execution environment, the complete invocation may be exposed through: - Process inspection facilities. - Shell history. - Agent tool-call transcripts. - Command auditing and endpoint monitoring. - Diagnostic bundles and crash reports. - Orchestration or execution logs. Although the access key must be supplied to the Reah API for the declared operation, placing it in `argv` exceeds the minimum exposure necessary. The documentation directly encourages this handling pattern. The script does not print the key itself, but that does not prevent surrounding execution infrastructure from recording the command line before or during execution. ### Attack Path 1. A user or agent follows the documented invocation and inserts a valid Reah access key into `--access-key`. 2. The plaintext key becomes part of the process command line. 3. A local user, monitoring service, agent transcript store, shell-history reader, or logging system captures that command line. 4. An unauthorized party extracts the access key from the retained command. 5. The party reuses the key against the Reah card-information work ...[truncated 605 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `--access-key` command-line option for normal operation. - Read the key through protected standard input or a dedicated inherited file descriptor. - Disable terminal echo if interactive secret entry is supported. - Preserve the documented explicit manual confirmation requirement before each environment-key read. - Do not interpolate the key into shell commands, tool-call text, logs, exceptions, or user-facing responses. - If file-based secret input is necessary, require restrictive permissions, avoid predictable temporary paths, and delete the file securely after use. - Minimize the lifetime of in-memory references and avoid including the key in diagnostic data. - Update `SKILL.md` so all examples demonstrate the protected input mechanism. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: get-card-info-example.mjs:10
• Finding: Legacy 1024-Bit RSA Key and RSA-OAEP with SHA-1<![CDATA[ ## Vulnerability Details **File Locations**: `get-card-info-example.mjs:10-16`; `get-card-info-example.mjs:105-117` **Vulnerability Type**: Obsolete cryptographic parameters protecting the card-data session secret **Risk Level**: Medium ### Vulnerable Code The embedded public key is a 1024-bit RSA key: ```js const REAH_CARD_RSA_PUBLIC_KEY = `-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCAP192809jZyaw62g/eTzJ3P9H +RmT88sXUYjQ0K8Bx+rJ83f22+9isKx+lo5UuV8tvOlKwvdDS/pVbzpG7D7NO45c 0zkLOXwDHZkou8fuj8xhDO5Tq3GzcrabNLRLVz3dkx0znfzGOhnY4lkOMIdKxlQb LuVM/dGDC9UpulF+UwIDAQAB -----END PUBLIC KEY-----`; ``` The key is imported for RSA-OAEP using SHA-1: ```js const rsaPublicKey = await cryptoApi.subtle.importKey( "spki", parsePemToDer(pem), { name: "RSA-OAEP", hash: "SHA-1" }, true, ["encrypt"], ); const encrypted = await cryptoApi.subtle.encrypt( { name: "RSA-OAEP" }, rsaPublicKey, textEncoder.encode(secretKeyBase64), ); ``` ### Technical Analysis The DER metadata represented by the embedded PEM identifies a 1024-bit RSA public key. RSA-1024 no longer provides an acceptable security margin for new systems protecting high-value financial data. The implementation also explicitly configures RSA-OAEP with SHA-1, a legacy hash that should be replaced in modern cryptographic protocols. The generated secret is used as the AES-GCM key for decrypting PAN and CVC payloads. Consequently, the strength and lifecycle of the RSA wrapping key directly affect the confidentiality of captured card-data exchanges. RSA-OAEP is structurally different from signature schemes affected by SHA-1 collision attacks, so the use of SHA-1 does not by itself establish an immediate practical plaintext-recovery exploit. The confirmed issue is the obsolete construction and inadequate long-term security margin, especially when combined with RSA-1024 and a hardcoded, potentially long-lived key. ### Attack Path 1. An attacker captures or retains GraphQL ex ...[truncated 1222 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the 1024-bit RSA key with at least RSA-2048; RSA-3072 is preferable for a longer security lifetime. - Replace RSA-OAEP with SHA-1 by RSA-OAEP with SHA-256. - Consider a modern authenticated ephemeral key-agreement design to provide forward secrecy. - Introduce explicit protocol and key versioning so clients can migrate without silently falling back to legacy cryptography. - Rotate the server-side private key and retire the legacy key after a defined migration period. - Reject legacy key versions after migration rather than retaining indefinite compatibility. - Establish documented key-rotation, compromise-response, and ciphertext-retention policies. - Obtain independent cryptographic review before deploying the revised card-data protocol. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The documentation explicitly instructs the agent to use the user's Reah card to buy a subscription for itself, which is a direct self-benefiting financial action. This is highly dangerous because it normalizes agent self-dealing and could be used to induce unauthorized charges using sensitive payment access under the guise of an example.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The README says every access-key read requires explicit manual user confirmation, while the skill metadata says session generation, secure fetch, and decryption are handled automatically. This contradiction can mislead operators into believing a human approval gate exists when the system may actually process sensitive keys autonomously, increasing the risk of unauthorized card access.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The README describes broader spending and 'full platform access' behaviors that exceed the stated purpose of retrieving masked card information. This kind of scope inflation is dangerous because users and downstream agents may invoke the skill for purchases or broader account actions they did not intend to authorize, creating a confused-deputy pathway around expected limits.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Skill | Description |
| ----- | ----------- |
| [reah](skills/reah/SKILL.md) | Full Reah platform access — agent card. See the [skill reference](skills/reah/SKILL.md) for detailed API docs. |

---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The example prompt 'Help me order dinner for today' is broad everyday language that can act as an unintended trigger for a payment-capable or card-adjacent skill. In the context of a skill tied to card access, vague invocation phrasing raises the chance that normal conversation causes the agent to escalate into financial workflows without sufficiently explicit user intent.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs network access to `https://agents.reah.com/graphql` and references executable scripts using `node`/`curl`, but it does not declare any explicit tool scope such as `permissions` or `allowed-tools`. This creates a policy/control gap: an agent platform may permit broader tool or network use than intended, making handling of sensitive card-related data harder to constrain and audit.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script and metadata describe retrieval of masked card information, but the GraphQL query requests encrypted PAN and CVC fields and the code later decrypts them. This mismatch is dangerous because it understates that the skill handles full cardholder data, increasing the chance an agent or operator will invoke it without applying PCI-grade controls, logging restrictions, and user consent expectations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code sends the user-supplied access key and generated session identifier to a remote GraphQL endpoint to retrieve encrypted card information. While the network call is central to the script's function, the file contains no user-facing print/log message, confirmation, or comment/docstring warning that sensitive payment-related identifiers are being transmitted off-host.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The code explicitly decrypts both encryptedPan and encryptedCvc, which goes beyond a simple masked-info fetch and exposes full payment card data in process memory. In an agent skill context, this is especially sensitive because downstream tools, prompts, traces, or debug hooks may inadvertently retain or disclose decrypted PAN/CVC values.

Static analysis

No suspicious patterns detected.