Reva
WarnAudited by ClawScan on May 10, 2026.
Overview
Reva is a coherent wallet skill, but it can submit crypto transfers after collecting details without an explicit final confirmation step.
Before installing, understand that this skill can manage a crypto wallet and submit transfers. Use it only if you trust the Reva API integration, and manually confirm transfer details before allowing any send-funds action.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A misunderstood request or parsing error could result in an unintended crypto transfer without an explicit last check.
This instructs the agent to submit a crypto transfer once it has parsed the fields, but the workflow does not require a separate final confirmation before the high-impact action.
Once ALL fields are collected, call: `{baseDir}/scripts/send-funds.sh <tokenSymbol> <chainSymbol> <recipient> <amount>`Require an explicit confirmation step showing recipient, token, chain, amount, and any fees before calling the transfer script.
Anyone who obtains this local auth file could potentially use the Reva session until the token expires or is cleared.
The skill stores a reusable Reva access token and account identifiers locally. The file permissions are restrictive and this supports the wallet purpose, but the stored token is sensitive.
AUTH_FILE="$AUTH_DIR/auth.json" ... '{token: $token, email: $email, privyId: $privyId, walletAddress: $walletAddr}' > "$AUTH_FILE" ... chmod 600 "$AUTH_FILE"Keep the machine account secure, provide an obvious logout/clear-token workflow, and avoid sharing logs or files from the auth directory.
The skill may fail or behave unexpectedly if jq or curl are absent, and users may not notice the local command dependency from registry metadata alone.
The skill depends on local command-line tools and bundled shell scripts, while the registry requirements shown for this review list no required binaries. This is a packaging/metadata mismatch, not evidence of malicious behavior.
dependencies: - jq - curl
Declare required binaries consistently in registry metadata and ensure users understand that the bundled scripts will run locally.