Security audit

Reivo

Security checks across malware telemetry and agentic risk

Overview

Reivo is a disclosed cost-optimization proxy skill that uses a Reivo API key to read and change Reivo account settings, with no hidden local persistence or unrelated behavior found.

Install only if you are comfortable routing AI API traffic through Reivo and letting the skill change Reivo account settings when asked. Use dedicated or scoped provider keys where possible, keep REIVO_API_KEY private, and double-check budget, routing-mode, and Slack webhook changes before applying them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill uses environment variables and performs outbound network requests, but those capabilities are not explicitly declared as permissions. This weakens user awareness and consent, especially because the skill sends an API key to a third-party service and can modify remote settings.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 80% confidence
Finding: The description focuses on cost tracking and optimization, but the skill also performs configuration-changing actions such as setting budgets, changing routing mode, and configuring Slack webhooks. This mismatch can mislead users about the operational scope and hide that the skill can alter account behavior, not just report status.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README explains the proxy architecture and metadata retention only later in the document, but the skill description and install flow do not prominently warn users that all model requests are routed through a third-party service. That can lead users to enable the skill without informed consent about data flow and logging of request metadata, which is especially risky for agents handling sensitive prompts, identifiers, or regulated workloads.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger language uses broad phrases like 'or similar' for cost-related actions, making invocation boundaries ambiguous. In an agent setting, this can cause unintended execution of network calls that expose spend data or act on user accounts without sufficiently specific intent.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The defense-status trigger includes vague prompts such as 'am I safe?', which can overlap with ordinary conversation and accidentally invoke remote status checks. This is risky because it sends credentials to an external service and may disclose account state when the user did not intend to query Reivo.

Vague Triggers

Medium

Confidence: 75% confidence
Finding: The optimization trigger is open-ended and may match general advice-seeking language unrelated to the service. This can lead to unnecessary external API calls and sharing of account telemetry context without clear user intent.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The budget-setting action is state-changing and financially significant, yet it is gated by vague wording like 'limit spending' and similar phrases. Ambiguous matching can cause unintended account modifications that block future requests or alter service behavior.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Clearing a budget limit removes a protective control, but the trigger is underspecified and could be activated from loosely related language. This increases the chance of accidental policy removal, which could expose the user to runaway costs.

Vague Triggers

Low

Confidence: 77% confidence
Finding: Slack webhook configuration is a sensitive outbound integration, but the trigger is broad and lacks activation constraints. Accidental or manipulated invocation could register an attacker-controlled webhook, causing operational data to be exfiltrated to an unauthorized destination.

External Transmission

Medium

Category: Data Exfiltration
Content: When the user asks "how much am I spending?", "show costs", "cost report", or similar: ```bash curl -s -H "Authorization: Bearer $REIVO_API_KEY" \ "https://app.reivo.dev/api/v1/overview?days=7" ```
Confidence: 83% confidence
Finding: curl -s -H "Authorization: Bearer $REIVO_API_KEY" \ "https://app.reivo.dev/api/v1/overview?days=7" ``` Present the response as: - Total spend for the period - Daily cost breakdown (as a simple text

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.