Reveal Reviewer skills

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:01 PM UTC
• Version: 1.0.1

Overview

The skill is mostly a disclosed Reveal review workflow, but it gives remotely supplied task instructions too much control over browser actions and screenshots without clear safety boundaries.

Install only if you are comfortable giving this skill a Reveal reviewer API key and letting it drive browser-based product reviews. Use a clean, isolated browser profile with no unrelated logged-in accounts, review task instructions before acting on them, avoid credentials or payments unless you explicitly intend them, and confirm screenshots do not contain sensitive information before submission.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:41
• Finding: Untrusted Remote Task Instructions Control Browser Actions## Vulnerability Details **File Location**: `SKILL.md:41-74, 219` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code Snippet ```markdown 3. **Validate goal alignment** - For each candidate task, GET `/tasks/{taskId}` and compare `instructions.objective`, `instructions.steps`, and `instructions.feedback` to the user's requested goal. - If a matching task exists and goal aligns, use **Task Review Mode**. ``` ```markdown - `instructions.objective` — what the reviewer should accomplish - `instructions.steps` — step-by-step guide - `instructions.feedback` — what kind of feedback to focus on - `website` — URL to navigate to Read the instructions carefully before starting the review. ``` ```markdown 1. Navigate to the task's `website` URL 2. Take a snapshot to understand the page structure 3. Follow the task instructions step by step 4. At each significant step: - Take a screenshot using agent-browser's snapshot feature - Note what you observe (good, bad, confusing, broken) - Try to interact with elements as instructed ``` ```markdown - Always follow the task instructions. Don't review aspects the task didn't ask about unless they're critical issues. ``` ### Technical Analysis The Skill obtains `instructions.objective`, `instructions.steps`, `instructions.feedback`, and the destination `website` from an external API. It then directs the agent to follow those remotely supplied instructions and interact with the supplied website. The documented goal-alignment check only determines whether a task relates to the user's requested review. It does not establish a security boundary for remote instructions. There are no explicit controls requiring the agent to: - Treat API responses and webpage content as untrusted data. - Reject instructions that attempt to override user or system constraints. - Prevent access to credentials, tokens, cookies, or unrelated private information. - Restrict navigation to ap ...[truncated 2106 chars]
• Remediation: ## Remediation Suggestions 1. Explicitly classify all API task fields and webpage content as untrusted data that cannot override system, developer, user, or Skill safety constraints. 2. Replace “always follow the task instructions” with a requirement to follow instructions only when they are safe, relevant, and within the user-authorized review scope. 3. Validate destination URLs before navigation: - Permit only `https` URLs. - Reject local, loopback, link-local, private-network, `file:`, `data:`, and other non-web targets. - Require approval before navigating away from the task's registered domain. 4. Prohibit remote instructions from requesting credentials, API keys, cookies, local files, environment variables, payment information, authentication changes, downloads, or command execution. 5. Require explicit user approval before login, account creation, form submission, file upload, purchase, payment, deletion, publication, or other consequential actions. 6. Constrain screenshots to the target product and require redaction of tokens, personal data, account details, and unrelated browser content. 7. Add instruction-injection detection and stop the workflow when API or webpage content asks the agent to ignore prior rules, change roles, reveal secrets, or use unrelated tools. 8. Record rejected instructions in the review findings rather than executing them.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Third-Party Browser Skill Installation## Vulnerability Details **File Location**: `SKILL.md:15-18` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - `agent-browser` skill installed for website navigation and screenshots - If not installed: `clawhub install TheSethRose/agent-browser` ``` ### Technical Analysis The documented installation command retrieves a third-party Skill by namespace and name without specifying an immutable version, commit, digest, checksum, or signature. Consequently, the dependency installed by a user may differ from the version originally assessed. Because this dependency performs browser navigation, interaction, and screenshot capture, a malicious or compromised update would operate in a security-sensitive context. The project provides no integrity verification procedure or documented review boundary for updates. This is a supply-chain weakness rather than evidence that the named dependency is currently malicious. ### Attack Path 1. The third-party dependency publisher account or distribution channel is compromised, transferred, or used to publish a malicious update. 2. An operator follows the documented command: `clawhub install TheSethRose/agent-browser`. 3. Because no immutable version or digest is specified, the package manager retrieves the current mutable release. 4. The altered dependency is invoked during a Reveal review. 5. Malicious dependency behavior executes with the browser access and process permissions granted to the installed Skill. 6. It can alter navigation, capture browsing information, manipulate review evidence, or perform other actions available through its granted capabilities. ### Impact Assessment The obtainable privileges are limited to those granted to the installed `agent-browser` Skill and its host process. Depending on deployment configuration, the impact may include: - Unauthorized access to browser-visible data and authenticated sessions. - Manipulation of nav ...[truncated 415 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to an audited immutable version, commit identifier, or content digest. 2. Verify a cryptographic checksum or trusted signature before installation. 3. Document the expected publisher identity, source repository, and approved artifact digest. 4. Review dependency updates before changing the pin; do not automatically track the latest release. 5. Run browser automation with least privilege in an isolated profile or sandbox that has no unrelated authenticated sessions. 6. Restrict the dependency's filesystem, network, environment-variable, and process-execution access to the minimum needed. 7. Maintain a dependency lock or manifest so deployed installations are reproducible and auditable.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Low

• Confidence: 85% confidence
• Finding: The manifest describes a skill for browsing review tasks, navigating target websites, recording observations, and submitting feedback on Reveal. The documented `/notifications` endpoints add a separate capability to list and mutate account notifications, which is not clearly justified by that review workflow as described.

Static analysis

No suspicious patterns detected.