reversa

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:39 PM UTC
• Version: 1.0.1

Overview

This skill is purpose-aligned but asks users to connect a mutable third-party MCP service to repository-wide analysis with unclear data boundaries.

Install only if you are comfortable trusting the Habilis MCP endpoint with repository-derived analysis results and generated contracts. Use a narrowly scoped token, avoid running it on repositories with secrets or highly sensitive business logic unless exclusions are enforced, and treat MCP responses as untrusted suggestions requiring review before file changes or commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37
• Finding: Unpinned and Unverifiable Remote MCP Service Controls Repository Analysis## Vulnerability Details **File Location**: `SKILL.md:37-56, 62-67, 75-89`; duplicated in `README.md:24-39, 57-72` **Vulnerability Type**: Third-party supply-chain trust without implementation pinning or integrity verification **Risk Level**: Medium ### Vulnerable Code ```markdown - [ ] **1. Habilis MCP Token (Obrigatório)**: - Obtenha seu token de acesso em [https://xvix.com.br](https://xvix.com.br). - Defina no seu ambiente: ```bash export HABILIS_API_KEY="hab_live_..." ``` - [ ] **2. Conexão MCP Habilis no `config.yaml`**: - Adicione o endpoint MCP no seu Hermes ou cliente MCP: ```yaml mcp_servers: habilis: url: "https://xvix.com.br/api/mcp" headers: Authorization: "Bearer ${HABILIS_API_KEY}" ``` - [ ] **3. Diretório do Projeto**: - Posicione o terminal na raiz do projeto legado a ser analisado. ### 🩺 Autodiagnóstico de Conectividade (Doctor) ```bash hermes run "reversa_analyze_legacy(projectPath='.', focusAreas=['architecture'])" ``` ``` ```markdown | Ferramenta | Descrição | | :--- | :--- | | `reversa_analyze_legacy` | Arqueologia de código, mapeamento de dependências, identificação de regras implícitas e débito técnico. | | `reversa_generate_sdd` | Sintetiza especificações executáveis (SDD) com contratos formais de entrada/saída, invariantes e casos de teste. | | `reversa_audit_contracts` | Compara modificações recentes com os contratos SDD gerados para garantir não-regressão e conformidade. | ``` ```markdown ```bash hermes run "reversa_analyze_legacy(projectPath='.', focusAreas=['architecture', 'business_rules', 'data_models'])" ``` ```bash hermes run "reversa_generate_sdd(moduleName='checkout_e_pagamentos', specType='complete_sdd')" ``` ```bash hermes run "reversa_audit_contracts(projectPath='.')" ``` ``` ### Technical Analysis The Skill instructs users to register `https://xvix.com.br/api ...[truncated 2538 chars]
• Remediation: ## Remediation Suggestions 1. Publish an auditable implementation of the MCP server or provide a local, open-source implementation for repository analysis. 2. Pin the MCP tool manifest, protocol version, and server release rather than trusting a mutable endpoint without version constraints. 3. Add cryptographic integrity and authenticity verification for tool manifests and other remotely supplied components. 4. Document every category of data transmitted to the service, including source fragments, paths, metadata, generated contracts, logs, and prompts. 5. Enforce repository access through an explicit allowlist and exclude secrets, `.env` files, credentials, private keys, build artifacts, and unrelated directories by default. 6. Require per-call user approval before transmitting repository-derived information or applying changes suggested by remote tool output. 7. Treat all MCP responses as untrusted data. Prevent remote output from directly authorizing shell commands, tool calls, file writes, or security-policy changes. 8. Run the MCP client with least privilege in a sandbox that limits filesystem, process, credential, and network access. 9. Replace unsupported zero-storage assurances with technically enforceable retention controls, verifiable privacy documentation, and clear incident-response procedures. 10. Use short-lived, narrowly scoped API tokens and provide revocation and rotation mechanisms.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation

Content

### 🚀 Quick Onboarding & First-Time Setup
1. **Get your Habilis MCP Token**:
   - Access the developer portal at [https://xvix.com.br](https://xvix.com.br) to generate your access token.
2. **Configure your Environment**:
   ```bash
   export HABILIS_API_KEY="hab_live_..."

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README instructs users to connect to a remote MCP endpoint and claims a 'Zero-Storage Architecture,' but it does not clearly and prominently warn that derived artifacts such as formal contracts will still be transmitted off-host. In a reverse-engineering skill, those contracts may encode sensitive business logic, schemas, invariants, or security-relevant behavior, so the documentation can mislead users about what leaves their environment.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases include generic Portuguese terms like 'engenharia reversa' and 'extrair sdd', which can plausibly appear in ordinary user requests and unintentionally activate the skill. Because the skill is designed to orchestrate MCP-backed analysis workflows and encourages use of external tooling, accidental invocation could cause unnecessary code analysis actions or route sensitive project context into the skill flow without clear user intent.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The skill description and operational instructions are presented entirely in Portuguese, with no indication that users may choose another language or locale. This can violate language/locale policy where user-facing skills must not force a specific language without opt-in.

Static analysis

No suspicious patterns detected.