ClawHub
Back to skill

Security audit

Reversal — Agent Input Reliability Layer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent document and URL parsing integration, but users should be careful with remote mode because submitted files and URLs may be processed by api.reversal.dev.

Use local stdio mode for sensitive documents where possible. If using HTTP mode, assume URLs, uploaded files, and parsed outputs may be sent to api.reversal.dev, and review the service's privacy, retention, and security practices before sending confidential data. Pin repository commits and package versions if installing in production or a credentialed environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:62
Finding

Unpinned Third-Party Repository and SDK Dependencies

Content
View full analysis
Remediation
View remediation
``` 2. Publish and verify signed release tags or signed provenance before installation. 3. Pin every direct and transitive Python dependency to an exact reviewed version. 4. Generate a hash-locked requirements file and require hash verification: ```bash pip install --require-hashes -r requirements.lock ``` 5. Pin the SDKs to exact reviewed versions rather than resolving the latest available releases: ```bash pip install reversal-sdk== npm install --save-exact reversal-client@ ``` 6. Commit and enforce an npm lockfile with integrity metadata, and use `npm ci` for reproducible installation. 7. Audit package ownership, release provenance, dependency names, and lifecycle scripts before recommending the packages. 8. Run installation and the MCP server in a dedicated, non-administrative, isolated environment with minimal filesystem access and without unrelated credentials. 9. Add automated dependency scanning and establish a controlled process for reviewing and updating pinned versions. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

}

text

For OpenAI Codex (`~/.codex/config.toml`):

```toml
[[mcp_servers]]

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly supports uploading local files and using a remote HTTP deployment, but it does not clearly warn that file contents and fetched URL data may leave the local host and be transmitted to a third-party service. In an agent context, this can cause inadvertent exfiltration of sensitive documents, internal reports, or credentials embedded in files if users assume parsing is local by default.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The registration command sends user email data to an external service, which is an external transmission not fully contextualized with privacy or trust boundaries. In a security-sensitive agent ecosystem, outbound transmission to a third-party endpoint can expose user identifiers and normalize sending data off-host without adequate warning.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

bash
# 1. Get a free API key
curl -X POST https://api.reversal.dev/v1/register \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'
# → { "api_key": "sk-rev-…" }

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The registration command sends user email data to an external service, which is an external transmission not fully contextualized with privacy or trust boundaries. In a security-sensitive agent ecosystem, outbound transmission to a third-party endpoint can expose user identifiers and normalize sending data off-host without adequate warning.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

bash
# 1. Get a free API key
curl -X POST https://api.reversal.dev/v1/register \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'
# → { "api_key": "sk-rev-…" }

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The HTTP MCP configuration directs agents to send requests and likely document content to a remote endpoint, but the skill does not provide sufficiently prominent warnings that source URLs, uploaded files, and normalized contents may be transmitted to a third-party service. This is especially relevant because the skill markets itself for document parsing, increasing the chance that sensitive enterprise content is sent externally.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
"mcpServers": {
    "reversal": {
      "transport": "http",
      "url": "https://api.reversal.dev/v1/mcp",
      "headers": { "Authorization": "Bearer sk-rev-YOUR_KEY" }
    }
  }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

toml
[[mcp_servers]]
name = "reversal"
url  = "https://api.reversal.dev/v1/mcp"
[mcp_servers.headers]
Authorization = "Bearer sk-rev-YOUR_KEY"

Static analysis

No suspicious patterns detected.