Reah Skill: Agent Card

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.0.3

Overview

This skill is not clearly malicious, but it handles full payment-card data and presents broad purchase examples without enough scoping or control.

Review carefully before installing. Only use this with explicit user approval for each card-key read, avoid putting real access keys in command-line arguments, do not use broad purchase prompts, and treat any decrypted PAN/CVC exposure as sensitive payment-card data requiring strict handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:15

Finding

Unpinned Executable Installer and Mutable Remote Source

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

Access Key Exposed Through Command-Line Arguments

Content

View full analysis

" ``` `get-card-info-example.mjs:34-41` parses the plaintext key from the process argument vector: ```js for (let i = 0; i < argv.length; i += 1) { const arg = argv[i]; switch (arg) { case "--access-key": opts.accessKey = argv[++i]; break; case "--timeout-ms": opts.timeoutMs = Number.parseInt(argv[++i], 10); break; ``` ### Technical Analysis Command-line arguments are not an appropriate transport for sensitive credentials. Depending on the host and execution environment, the complete invocation may be exposed through: - Process inspection facilities. - Shell history. - Agent tool-call transcripts. - Command auditing and endpoint monitoring. - Diagnostic bundles and crash reports. - Orchestration or execution logs. Although the access key must be supplied to the Reah API for the declared operation, placing it in `argv` exceeds the minimum exposure necessary. The documentation directly encourages this handling pattern. The script does not print the key itself, but that does not prevent surrounding execution infrastructure from recording the command line before or during execution. ### Attack Path 1. A user or agent follows the documented invocation and inserts a valid Reah access key into `--access-key`. 2. The plaintext key becomes part of the process command line. 3. A local user, monitoring service, agent transcript store, shell-history reader, or logging system captures that command line. 4. An unauthorized party extracts the access key from the retained command. 5. The party reuses the key against the Reah card-information work ...[truncated 605 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: get-card-info-example.mjs:10

Finding

Legacy 1024-Bit RSA Key and RSA-OAEP with SHA-1

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation explicitly instructs the agent to use the user's Reah card to buy a subscription for itself, which is a direct self-benefiting financial action. This is highly dangerous because it normalizes agent self-dealing and could be used to induce unauthorized charges using sensitive payment access under the guise of an example.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README says every access-key read requires explicit manual user confirmation, while the skill metadata says session generation, secure fetch, and decryption are handled automatically. This contradiction can mislead operators into believing a human approval gate exists when the system may actually process sensitive keys autonomously, increasing the risk of unauthorized card access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README describes broader spending and 'full platform access' behaviors that exceed the stated purpose of retrieving masked card information. This kind of scope inflation is dangerous because users and downstream agents may invoke the skill for purchases or broader account actions they did not intend to authorize, creating a confused-deputy pathway around expected limits.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

md

| Skill | Description |
| ----- | ----------- |
| [reah](skills/reah/SKILL.md) | Full Reah platform access — agent card. See the [skill reference](skills/reah/SKILL.md) for detailed API docs. |

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example prompt 'Help me order dinner for today' is broad everyday language that can act as an unintended trigger for a payment-capable or card-adjacent skill. In the context of a skill tied to card access, vague invocation phrasing raises the chance that normal conversation causes the agent to escalate into financial workflows without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill clearly instructs network access to https://agents.reah.com/graphql and references executable scripts using node/curl, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a policy/control gap: an agent platform may permit broader tool or network use than intended, making handling of sensitive card-related data harder to constrain and audit.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script and metadata describe retrieval of masked card information, but the GraphQL query requests encrypted PAN and CVC fields and the code later decrypts them. This mismatch is dangerous because it understates that the skill handles full cardholder data, increasing the chance an agent or operator will invoke it without applying PCI-grade controls, logging restrictions, and user consent expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code sends the user-supplied access key and generated session identifier to a remote GraphQL endpoint to retrieve encrypted card information. While the network call is central to the script's function, the file contains no user-facing print/log message, confirmation, or comment/docstring warning that sensitive payment-related identifiers are being transmitted off-host.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code explicitly decrypts both encryptedPan and encryptedCvc, which goes beyond a simple masked-info fetch and exposes full payment card data in process memory. In an agent skill context, this is especially sensitive because downstream tools, prompts, traces, or debug hooks may inadvertently retain or disclose decrypted PAN/CVC values.

Content

No source excerpt is available for this finding.