ClawHub
Back to skill

Security audit

reversa

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but asks users to connect a mutable third-party MCP service to repository-wide analysis with unclear data boundaries.

Install only if you are comfortable trusting the Habilis MCP endpoint with repository-derived analysis results and generated contracts. Use a narrowly scoped token, avoid running it on repositories with secrets or highly sensitive business logic unless exclusions are enforced, and treat MCP responses as untrusted suggestions requiring review before file changes or commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:37
Finding

Unpinned and Unverifiable Remote MCP Service Controls Repository Analysis

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:37-56, 62-67, 75-89; duplicated in README.md:24-39, 57-72
Vulnerability Type: Third-party supply-chain trust without implementation pinning or integrity verification
Risk Level: Medium

Vulnerable Code

markdown
- [ ] **1. Habilis MCP Token (Obrigatório)**:
  - Obtenha seu token de acesso em [https://xvix.com.br](https://xvix.com.br).
  - Defina no seu ambiente:
    ```bash
    export HABILIS_API_KEY="hab_live_..."
    ```
- [ ] **2. Conexão MCP Habilis no `config.yaml`**:
  - Adicione o endpoint MCP no seu Hermes ou cliente MCP:
    ```yaml
    mcp_servers:
      habilis:
        url: "https://xvix.com.br/api/mcp"
        headers:
          Authorization: "Bearer ${HABILIS_API_KEY}"
    ```
- [ ] **3. Diretório do Projeto**:
  - Posicione o terminal na raiz do projeto legado a ser analisado.

### 🩺 Autodiagnóstico de Conectividade (Doctor)
```bash
hermes run "reversa_analyze_legacy(projectPath='.', focusAreas=['architecture'])"
text

```markdown
| Ferramenta | Descrição |
| :--- | :--- |
| `reversa_analyze_legacy` | Arqueologia de código, mapeamento de dependências, identificação de regras implícitas e débito técnico. |
| `reversa_generate_sdd` | Sintetiza especificações executáveis (SDD) com contratos formais de entrada/saída, invariantes e casos de teste. |
| `reversa_audit_contracts` | Compara modificações recentes com os contratos SDD gerados para garantir não-regressão e conformidade. |
markdown
```bash
hermes run "reversa_analyze_legacy(projectPath='.', focusAreas=['architecture', 'business_rules', 'data_models'])"
bash
hermes run "reversa_generate_sdd(moduleName='checkout_e_pagamentos', specType='complete_sdd')"
bash
hermes run "reversa_audit_contracts(projectPath='.')"
text

### Technical Analysis

The Skill instructs users to register `https://xvix.com.br/api
...[truncated 2538 chars]
Remediation
View remediation

Remediation Suggestions

  1. Publish an auditable implementation of the MCP server or provide a local, open-source implementation for repository analysis.
  2. Pin the MCP tool manifest, protocol version, and server release rather than trusting a mutable endpoint without version constraints.
  3. Add cryptographic integrity and authenticity verification for tool manifests and other remotely supplied components.
  4. Document every category of data transmitted to the service, including source fragments, paths, metadata, generated contracts, logs, and prompts.
  5. Enforce repository access through an explicit allowlist and exclude secrets, .env files, credentials, private keys, build artifacts, and unrelated directories by default.
  6. Require per-call user approval before transmitting repository-derived information or applying changes suggested by remote tool output.
  7. Treat all MCP responses as untrusted data. Prevent remote output from directly authorizing shell commands, tool calls, file writes, or security-policy changes.
  8. Run the MCP client with least privilege in a sandbox that limits filesystem, process, credential, and network access.
  9. Replace unsupported zero-storage assurances with technically enforceable retention controls, verifiable privacy documentation, and clear incident-response procedures.
  10. Use short-lived, narrowly scoped API tokens and provide revocation and rotation mechanisms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

🚀 Quick Onboarding & First-Time Setup

  1. Get your Habilis MCP Token:
  2. Configure your Environment:
    bash
    export HABILIS_API_KEY="hab_live_..."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README instructs users to connect to a remote MCP endpoint and claims a 'Zero-Storage Architecture,' but it does not clearly and prominently warn that derived artifacts such as formal contracts will still be transmitted off-host. In a reverse-engineering skill, those contracts may encode sensitive business logic, schemas, invariants, or security-relevant behavior, so the documentation can mislead users about what leaves their environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger phrases include generic Portuguese terms like 'engenharia reversa' and 'extrair sdd', which can plausibly appear in ordinary user requests and unintentionally activate the skill. Because the skill is designed to orchestrate MCP-backed analysis workflows and encourages use of external tooling, accidental invocation could cause unnecessary code analysis actions or route sensitive project context into the skill flow without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description and operational instructions are presented entirely in Portuguese, with no indication that users may choose another language or locale. This can violate language/locale policy where user-facing skills must not force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.