review-times

• Outcome: Pass
• Latest audit: Sep 25, 2026 · 2:57 AM UTC
• Version: 1.0.0

Overview

This skill is a simple review-time lookup and reporting helper, but users should avoid its plain HTTP examples when submitting or updating reports.

Before installing, treat the reporting feature as public or semi-public crowdsourcing. If you submit a report, use explicit https:// URLs, do not store the returned token in ordinary project notes that may be shared or committed, and only report real submissions you are comfortable sending to reviewtimes.fyi.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25

Finding

Cleartext HTTP exposes submission data and report update tokens

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–35
Vulnerability Type: Cleartext transmission of sensitive report data and bearer-style tokens
Risk Level: Medium

bash

curl -s -X POST reviewtimes.fyi/api/v1/reports -H 'content-type: application/json' \
  -d '{"store":"claude-plugins","submitted_on":"2026-09-01","status":"waiting"}'

Save the returned token (for example in the project's notes) and update it when the store answers:

bash

curl -s -X PATCH reviewtimes.fyi/api/v1/reports/$TOKEN -H 'content-type: application/json' \
  -d '{"status":"approved","decided_on":"2026-09-20"}'

Technical Analysis

The documented curl commands use scheme-less URLs. In this context, curl treats the endpoint as HTTP rather than explicitly requiring authenticated HTTPS transport. The POST request transmits the user's store, submission date, and review status. The PATCH request places the server-issued update token in the URL and sends updated report information over the same unencrypted transport.

This issue is reachable when a user authorizes reporting a real submission and the agent follows the documented commands. An on-path attacker positioned between the user's environment and reviewtimes.fyi could inspect or modify HTTP traffic. The instructions do require the user's go-ahead before creating a report, but that confirmation does not protect the resulting network traffic.

Attack Path

1. The user authorizes the Skill to report a real store submission.
2. The agent executes the documented POST command using the scheme-less endpoint.
3. The request travels over cleartext HTTP, allowing an on-path attacker to observe the submission metadata or alter the request and response.
4. The remote response returns a token used to update the report.
5. When the agent later executes the documented PATCH command, the token appears in the cleartext request URL.
6. The attacker captures the t ...[truncated 596 chars]

Remediation

View remediation

Remediation Suggestions

• Replace every scheme-less endpoint with an explicit HTTPS URL:
  • https://reviewtimes.fyi/api/v1/reports
  • https://reviewtimes.fyi/api/v1/reports/$TOKEN
• Require TLS certificate verification and do not add options such as --insecure.
• Avoid storing the returned token in ordinary project notes, which may be committed, shared, or exposed to unrelated project tooling.
• Store the token in an OS credential store or a permission-restricted file outside the project tree.
• Prefer sending update credentials in an authorization header rather than embedding them in the URL, if the API supports that mechanism.
• Document token revocation or report-token rotation procedures in case a token is exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

Check

bash

curl -s reviewtimes.fyi                  # every store, one table
curl -s reviewtimes.fyi/claude-plugins   # one store, with how its review works
curl -s reviewtimes.fyi/api/v1/stores/chatgpt   # JSON

Static analysis

No suspicious patterns detected.