ClawHub
Back to skill

Security audit

Reporead

Security checks for vulnerabilities and agentic risk

Overview

RepoRead is a coherent repository-analysis skill that uses a disclosed external API and API key, with credential-handling and consent cautions users should understand before use.

Install only if you are comfortable sending repository URLs, analysis requests, and resulting repository context to RepoRead. Use it for public repositories by default, confirm authorization before using it on private or proprietary code, and store the API key in a protected secret manager or restricted config file rather than committing it or placing it in shared dotfiles.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Plaintext API Key Persistence in Shell and MCP Configuration

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill invokes shell scripts and documents direct shell usage, but it does not declare an explicit tool scope such as allowed-tools or permissions. That omission increases the chance the agent can execute commands more broadly than intended, which weakens containment and makes misuse or accidental overreach harder to prevent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: reporead
version: 1.2.0
description: Analyze GitHub repositories using RepoRead AI. Use when the user asks to "analyze a repo", "generate docs", "security audit a repo", "create a README", or wants AI-powered repository analysis. Supports MCP server integration and REST API.
metadata:
  clawdis:
    primaryEnv: REPOREAD_API_KEY

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger description is broad enough to match common requests like 'generate docs' or 'create a README,' which can cause the skill to activate in situations where the user did not intend external repository analysis. In this skill, overbroad activation is more dangerous because activation may lead to network calls and transmission of repository data to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill repeatedly instructs the agent to import and analyze repositories using a remote service, but it does not prominently require a user-facing warning that repository contents and metadata will be transmitted to RepoRead. This creates a real risk of unintentional exfiltration of proprietary, private, or sensitive code to an external vendor.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The MCP configuration sends requests and authentication headers to an external endpoint at api.reporead.com. While expected for the product, this is still a true security-relevant issue because using the skill causes outbound transmission of repository-related data and exposes a bearer token to a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
"mcpServers": {
    "reporead": {
      "type": "streamable-http",
      "url": "https://api.reporead.com/mcp",
      "headers": {
        "Authorization": "Bearer rrk_your_api_key_here"
      }

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The REST API instructions direct the agent to send repository URLs, analysis requests, and authentication credentials to RepoRead's external API. In context, that means codebase information may leave the local environment, which is materially dangerous for private repositories or sensitive enterprise source code.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
Or call the REST API directly:

**Base URL:** `https://api.reporead.com/public/v1`
**Auth:** `Authorization: Bearer $REPOREAD_API_KEY`

| Endpoint | Method | Description |

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/check-connection.sh (reported line 8)May include surrounding context.

sh
set -euo pipefail

API_KEY="${REPOREAD_API_KEY:-}"
BASE_URL="https://api.reporead.com/public/v1"

if [ -z "$API_KEY" ]; then
  echo "Error: REPOREAD_API_KEY is not set."

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/reporead-api.sh (reported line 8)May include surrounding context.

sh
set -euo pipefail

API_KEY="${REPOREAD_API_KEY:-}"
BASE_URL="https://api.reporead.com/public/v1"

if [ -z "$API_KEY" ]; then
  echo "Error: REPOREAD_API_KEY is not set."

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/reporead-api.sh (reported line 63)May include surrounding context.

sh
case "$cmd" in
  balance)
    curl -sf -H "$auth_header" "$BASE_URL/tokens/balance"
    ;;
  repos)
    page="${2:-1}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/reporead-api.sh (reported line 88)May include surrounding context.

sh
safe_repo_id=$(sanitize_json_value "$repo_id")
    safe_type=$(sanitize_json_value "$analysis_type")
    json_body=$(printf '{"repository_id": "%s", "analysis_type": "%s"}' "$safe_repo_id" "$safe_type")
    curl -sf -X POST -H "$auth_header" -H "Content-Type: application/json" \
      -d "$json_body" "$BASE_URL/analyses"
    ;;
  status)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This shell script performs multiple outbound HTTP requests to a third-party service using user-supplied repository data and analysis IDs. While the script's purpose implies API use, there is no explicit disclosure in the command descriptions or runtime output that these values are transmitted off-system to api.reporead.com.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.