Amazon Review Reveyes

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:20 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Amazon-review fetching integration, with ordinary third-party API and credential risks that users should understand before installing.

Install only if you are comfortable sending ASINs, marketplace choices, and review-fetch requests to Reveyes and using API credits. Prefer a protected secret store or tightly permissioned config for REVEYES_API_KEY, and consider pinning the Reveyes SDK version in controlled environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:12
• Finding: Unbounded Third-Party SDK Can Execute Unreviewed Supply-Chain Code<![CDATA[ ## Vulnerability Details **File Location**: `clawhub.json:12`; related installation instruction at `README.md:24-26` **Vulnerability Type**: Unbounded third-party dependency **Risk Level**: Medium ### Vulnerable Code `clawhub.json:12`: ```json "pip": ["reveyes>=0.1.2"] ``` `README.md:24-26`: ```bash pip install reveyes ``` ### Technical Analysis The Skill installs the externally maintained `reveyes` Python package without an exact version pin or integrity hash. The `>=0.1.2` constraint permits future package versions that were not part of this audit, while the manual installation command resolves the latest version available from the configured Python package index. The package is imported and executed by `scripts/fetch.py`, and its `ReveyesClient` receives the `REVEYES_API_KEY`. The dependency also performs the Skill's network communication. Because its implementation is not included in the audited project, this repository cannot enforce which network destinations receive the credential or what additional local operations the package performs. No evidence establishes that the currently intended SDK version is malicious. The issue is the avoidable supply-chain exposure created by accepting arbitrary future releases. ### Attack Path 1. An attacker compromises the `reveyes` package publisher account, distribution infrastructure, or an accepted future release. 2. The user installs the Skill or follows `pip install reveyes`. 3. Dependency resolution selects the compromised version because no exact version or hash is required. 4. Python executes package-level code when `scripts/fetch.py` imports `reveyes`. 5. The compromised implementation receives the API key through `ReveyesClient(api_key=api_key)`. 6. Malicious package code can transmit the key or access resources available to the Agent's operating-system account. ### Impact Assessment Successful exploitation would execute Python code with the same privileges as the process running the Ski ...[truncated 342 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the lower-bound dependency with an exact, reviewed version, for example: ```json "pip": ["reveyes==0.1.2"] ``` 2. Use a lockfile or requirements file containing cryptographic hashes, and install with hash verification where the deployment platform supports it. 3. Review the pinned SDK source, particularly import-time behavior, API-key handling, telemetry, and destination URLs. 4. Document the network hosts the SDK is expected to contact and restrict outbound traffic to those hosts where practical. 5. Upgrade only through a controlled process that reviews the new version and updates the corresponding integrity hash. 6. Run the Skill under a dedicated, least-privileged account or sandbox with access only to the required API credential and project resources. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: README.md:32
• Finding: Documentation Encourages Persistent Plaintext API-Key Storage<![CDATA[ ## Vulnerability Details **File Location**: `README.md:32-46` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Low ### Vulnerable Code ```bash # Add to ~/.zshrc or ~/.bashrc export REVEYES_API_KEY="your_api_key_here" ``` ```json { "env": { "REVEYES_API_KEY": "your_api_key_here" } } ``` ### Technical Analysis The setup instructions encourage users to persist the Reveyes API key directly in shell startup files or `~/.openclaw/openclaw.json`. These are plaintext files and may be readable by other software running under the same account, copied into backups, included in diagnostic archives, or accidentally committed or shared. The executable itself retrieves only the specifically declared `REVEYES_API_KEY` and does not print it. Passing that credential to the Reveyes client is necessary for the declared API functionality. The weakness is therefore in recommended secret storage rather than unrelated credential collection or proven exfiltration. ### Attack Path 1. A user follows the README and stores a valid API key in a shell profile or OpenClaw configuration file. 2. The file is exposed through insecure permissions, malware running as the same user, a backup, a support bundle, or accidental repository inclusion. 3. An attacker extracts the plaintext value. 4. The attacker authenticates to the Reveyes service using the stolen key and consumes the victim's API credits or accesses any data available to that credential. ### Impact Assessment Exposure could permit unauthorized use of the Reveyes account and consumption of paid API credits. Any additional impact depends on the service-side permissions attached to the key. This issue does not independently provide system privilege escalation. Access is limited to the local files readable by the attacking process and the remote privileges assigned to the disclosed API key. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an operating-system keychain, dedicated secret manager, or OpenClaw-supported protected credential facility instead of shell profiles. 2. If file-based configuration is unavoidable, instruct users to apply restrictive permissions such as owner-only read/write access. 3. Warn users not to commit configuration files containing real credentials and provide appropriate ignore-file examples. 4. Recommend short-lived or narrowly scoped credentials if the service supports them. 5. Add explicit key-rotation and revocation instructions for suspected exposure. 6. Ensure logs, error messages, diagnostics, and task output continue to exclude the API-key value. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Session Persistence

Medium

• Category: Rogue Agent

Content

Get your key free at **[www.reveyes.cn](https://www.reveyes.cn)** → Dashboard → API Keys.

```bash
# Add to ~/.zshrc or ~/.bashrc
export REVEYES_API_KEY="your_api_key_here"
```

• Confidence: 90% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README tells users to 'Just talk to your OpenClaw agent naturally' but all invocation examples are in Chinese, which implies a language-specific usage expectation without opt-in or justification. This is a natural-language policy concern because the skill documentation does not state whether other languages are supported or whether Chinese is required.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill requires an API key and instructs execution of a local script, but it declares no explicit tool scope or allowed-tools boundary. That creates an authorization gap where an agent may invoke code or access secrets without a clearly documented permission model, increasing the chance of overbroad execution or secret exposure.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The invocation criteria are broad enough to overlap with generic product-analysis or feedback-analysis requests, which can cause the skill to trigger when a user did not explicitly request external data retrieval. In context, that may lead to unintended third-party API calls, unnecessary data export, or use of paid credits without clear user intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The output section describes presenting and exporting review data but does not clearly warn that the data is obtained through an external third-party API. This reduces user transparency around outbound data access and export behavior, which can create privacy, compliance, and consent issues, especially in enterprise environments.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code includes user-facing error strings only in Chinese for multiple failure cases, which imposes a specific language on users without offering a choice. That is a natural-language policy concern because the file does not document that the skill is China-specific or otherwise limited to Chinese-speaking users.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The README describes fetching Amazon reviews through the Reveyes API but does not clearly warn users that their ASINs, marketplace selections, and resulting review content are transmitted to and processed by a third-party service. This creates a transparency and privacy risk: users may unknowingly send potentially sensitive research targets or business-intelligence queries to an external provider.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The skill instructions are written as Chinese-first usage guidance ('Use when' conditions expressed for Chinese-speaking users), while example outputs include English review text, and there is no statement that users may choose their preferred language. This can create a locale/language policy issue because the skill appears tailored to a specific language context without explicit opt-in or alternatives.

Static analysis

No suspicious patterns detected.