T09 · Insecure Skill Coding Practices
Error
- Location
scripts/verify-otp.sh:25- Finding
Authentication Token Disclosed Through Verification Script Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Reva
Security checks for vulnerabilities and agentic risk
Overview
This Reva wallet skill performs real crypto-wallet actions and has credential-handling and transfer-confirmation gaps that users should review carefully before installing.
Install only if you trust Reva and are comfortable with an agent holding a local wallet access token. Before using transfers, manually confirm the exact recipient, network, token, and amount, and avoid entering OTPs or initiating transfers in environments where command output or process arguments may be logged.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/verify-otp.sh:6- Finding
One-Time Password and Email Exposed Through Process Arguments
- Content
View full analysis
` 3. Inform user that OTP has been sent to their email 4. Ask user to provide the OTP code they received 5. Call the verification script: `{baseDir}/scripts/verify-otp.sh ` 6. If successful, inform user they are now authenticated 7. The access token is automatically stored for future use ``` The script reads those values directly from its argument vector: ```bash EMAIL="$1" OTP="$2" if [ -z "$EMAIL" ] || [ -z "$OTP" ]; then echo '{"success": false, "error": "Email and OTP are required"}' ``` ### Technical Analysis Command-line arguments are not an appropriate transport for short-lived authentication secrets. Depending on the host environment, process arguments may be exposed through: - Process inspection interfaces and tools. - Agent tool-call records. - Shell history or command auditing. - Endpoint monitoring and process telemetry. - Diagnostic or error reports. The OTP is short-lived, which limits the exploitation window, but it is sufficient to complete the passwordless authentication flow while valid. The accompanying email identifies the account against which the OTP should be submitted. ### Attack Path 1. A user receives an OTP and supplies it to the agent. 2. The agent follows `SKILL.md` and invokes `verify-otp.sh` with the email and OTP as arguments. 3. A local observer, auditing service, process monitor, or tool-call logging system records the command arguments. 4. The attacker extracts the email and OTP before the OTP expires or is consumed. 5. The attacker submits them t ...[truncated 711 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/auth-manager.sh:15- Finding
Unnecessary Personal Account Data Persisted Alongside Bearer Token
- Content
View full analysis
"$AUTH_FILE" chmod 600 "$AUTH_FILE" } ``` ### Technical Analysis Protected API scripts retrieve only the token from `auth.json`; the persisted email address, Privy identifier, and wallet address are not required for authenticated API calls. Storing these fields therefore exceeds the minimum local-data requirement. The final file mode is restricted to `600`, and its parent directory is set to `700`, which appropriately limits ordinary access. However, the sensitive file is initially created by shell redirection before `chmod 600` executes. Its initial permissions are controlled by the current process umask. With a permissive umask, there may be a brief window in which the file is more broadly readable. Combining personal identifiers and a bearer token in one persistent file also increases the consequences of local compromise, accidental backup exposure, or insecure collection by support and diagnostic tools. ### Attack Path 1. The user completes OTP authentication. 2. `verify-otp.sh` passes the token, email, Privy ID, and wallet address to `auth-manager.sh`. 3. Shell redirection creates or truncates `auth.json` using permissions derived from the active umask. 4. The complete credential and identity bundle is written to disk. 5. A malicious local process, compromised backup, or diagnostic collector obtains the ...[truncated 776 chars]- Remediation
View remediation
"$temp_file"; then rm -f "$temp_file" exit 1 fi chmod 600 "$temp_file" mv -f "$temp_file" "$AUTH_FILE" } ``` Additional hardening measures: - Set `umask 077` before creating any credential or state file. - Use atomic temporary-file creation and replacement to prevent partial writes and reduce permission windows. - Store the token in an operating-system credential manager where available. - Do not persist email, Privy ID, or wallet address unless a documented feature requires them. - Define token retention and logout behavior clearly. - Ensure logout securely removes all authentication state and consider server-side token revocation. - Exclude credential files from backups, diagnostics, and telemetry wherever practical. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (39)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This mismatch is more serious because the skill is presented as wallet management but apparently includes chat/message forwarding and local room-state persistence unrelated to the stated purpose. Hidden messaging behavior can create an unexpected data flow path to external services, increasing risk of sensitive prompt or transaction data being sent off-platform.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch is more serious because the skill is presented as wallet management but apparently includes chat/message forwarding and local room-state persistence unrelated to the stated purpose. Hidden messaging behavior can create an unexpected data flow path to external services, increasing risk of sensitive prompt or transaction data being sent off-platform.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch is more serious because the skill is presented as wallet management but apparently includes chat/message forwarding and local room-state persistence unrelated to the stated purpose. Hidden messaging behavior can create an unexpected data flow path to external services, increasing risk of sensitive prompt or transaction data being sent off-platform.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Authentication Reva uses a passwordless authentication flow. Users receive a one-time password (OTP) via email, verify it, and receive an access token for subsequent operations. ### Login/Register Flow
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Authentication Reva uses a passwordless authentication flow. Users receive a one-time password (OTP) via email, verify it, and receive an access token for subsequent operations. ### Login/Register Flow
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Authentication Reva uses a passwordless authentication flow. Users receive a one-time password (OTP) via email, verify it, and receive an access token for subsequent operations. ### Login/Register Flow
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Authentication Reva uses a passwordless authentication flow. Users receive a one-time password (OTP) via email, verify it, and receive an access token for subsequent operations. ### Login/Register Flow
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Authentication Reva uses a passwordless authentication flow. Users receive a one-time password (OTP) via email, verify it, and receive an access token for subsequent operations. ### Login/Register Flow
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Authentication Reva uses a passwordless authentication flow. Users receive a one-time password (OTP) via email, verify it, and receive an access token for subsequent operations. ### Login/Register Flow
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Authentication Reva uses a passwordless authentication flow. Users receive a one-time password (OTP) via email, verify it, and receive an access token for subsequent operations. ### Login/Register Flow
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Authentication Reva uses a passwordless authentication flow. Users receive a one-time password (OTP) via email, verify it, and receive an access token for subsequent operations. ### Login/Register Flow
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill explicitly requires local storage and reuse of an access token for protected operations, creating a durable credential on disk for a cryptocurrency wallet. If the local environment or other skills are compromised, this token could be reused to access balances, profile data, and initiate transactions without re-verifying the user.
- Content
md 2. System sends OTP to the email 3. User provides the OTP code 4. System verifies OTP and returns access token 5. Access token is stored securely for future operations **The access token MUST be stored securely after verification and reused for all protected operations.**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Mandating persistent storage of the access token increases the blast radius of any host compromise or cross-skill file exposure. In the context of a wallet skill, theft of this token could directly enable unauthorized viewing of sensitive account data and potentially financial operations.
- Content
md 4. System verifies OTP and returns access token 5. Access token is stored securely for future operations **The access token MUST be stored securely after verification and reused for all protected operations.** ## Available Commands
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
Automatically storing the access token for future use creates persistent credential material beyond the immediate login flow. Because this skill manages crypto-wallet actions, persistent bearer-token storage materially raises the risk of account takeover if the environment is shared or compromised.
- Content
md 4. Ask user to provide the OTP code they received 5. Call the verification script: `{baseDir}/scripts/verify-otp.sh <email> <otp>` 6. If successful, inform user they are now authenticated 7. The access token is automatically stored for future use ### 2. Claim PayID
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow allows immediate execution of cryptocurrency transfers once fields are parsed, without an explicit final user confirmation. For irreversible blockchain transfers, this is highly dangerous because intent-parsing mistakes, prompt confusion, or malicious conversational steering can result in permanent loss of funds.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Storing wallet access tokens in a predictable local file path under the user's home directory creates a credential theft target. Even with restrictive permissions, bearer tokens on disk remain valuable and may be exposed through host compromise, backups, logs, or other local tooling.
- Content
md **Token Storage:** - Access tokens are stored locally in `~/.openclaw/payid/auth.json` with restricted file permissions (chmod 600) - This is a standard OAuth/JWT token pattern - tokens are stored locally for session persistence - Users can clear their token at any time by deleting the auth file or using the skill's logout functionality - Tokens expire and require re-authentication when invalid
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Data Security:** - Never log or display access tokens to the user - OTP codes are only entered once and never stored - All API requests use HTTPS encryption (enforced in scripts) - All JSON payloads are constructed using `jq` to prevent injection attacks
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 94% confidence
- Finding
The workflow says to forward user messages to 'Reva AI', introducing an external message-passing path that may transmit sensitive financial instructions, identifiers, or account context outside the documented wallet API endpoints. In a wallet skill, undocumented forwarding behavior is dangerous because it can exfiltrate user data and reduce control over how transaction intent is interpreted.
- Content
md ### Send Funds (Simple) 1. User: "send 0.01 usdt on bnb to aldo" 2. Forward message to Reva AI 3. Reva AI processes and sends funds 4. Display transaction confirmation with links
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This script performs a live funds transfer immediately once invoked, with no confirmation prompt, review step, or dry-run behavior before an irreversible financial action. In a wallet-management skill context, that increases the chance of accidental or socially engineered transfers because a caller can trigger value movement with only positional arguments.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes shell scripts but does not declare any explicit tool scope or allowed-tools restrictions. In an agent environment, this weakens isolation and reviewability, making it easier for the skill to gain broader execution capability than users or the platform expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Overly broad login/register triggers can cause the skill to activate during generic authentication-related conversation, increasing the chance of unsolicited OTP flows or collection of email addresses. In a wallet context, accidental activation is riskier because it can lead users into credential and account-linking actions they did not intend.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The balance-check trigger includes very general wording like checking how much money a user has, which may activate in ordinary financial discussion. Because the skill accesses authenticated wallet data, this could disclose sensitive balances when the user did not explicitly mean to query Reva.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The account-info trigger is broad enough to catch generic personal-information questions, potentially causing the skill to retrieve and expose private account attributes like email, wallet address, referral code, or social handles. In a financial skill, unintended disclosure of this data materially increases privacy and targeting risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Generic transfer triggers like 'pay someone' or 'send money' can collide with everyday conversation and activate a real fund-transfer workflow. In a wallet-management skill, accidental activation is especially dangerous because it may lead to irreversible financial actions.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh AUTH_FILE="$AUTH_DIR/auth.json" mkdir -p "$AUTH_DIR" chmod 700 "$AUTH_DIR" get_token() { if [ -f "$AUTH_FILE" ]; then
Static analysis
No suspicious patterns detected.