ClawHub
Back to skill

Security audit

Reveyes Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it uses a Reveyes API key to fetch Amazon review data, with no evidence of hidden persistence, unrelated access, or malicious behavior.

Install only if you are comfortable sending Amazon ASINs and review-query parameters to Reveyes and using a Reveyes API key. Prefer a dedicated, revocable key, watch credit usage, and consider pinning or reviewing the reveyes package in controlled environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
clawhub.json:9
Finding

Unpinned Third-Party SDK Handles the API Credential

Content
View full analysis

Vulnerability Details

File Location: clawhub.json:9-12; related installation guidance at README.md:26-30; credential use at scripts/fetch.py:12-18 and scripts/fetch.py:36-44
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete vulnerable code snippets:

clawhub.json:9-12

json
"requires": {
  "env": ["REVEYES_API_KEY"],
  "pip": ["reveyes>=0.1.2"]
},

README.md:26-30

bash
Then install the Python dependency:

```bash
pip install reveyes
text

`scripts/fetch.py:12-18`
```python
try:
    from reveyes import ReveyesClient
    from reveyes.exceptions import (
        AuthenticationError,
        BadParamsError,
        InsufficientCreditsError,
    )

scripts/fetch.py:36-44

python
api_key = os.environ.get("REVEYES_API_KEY")
if not api_key:
    print(json.dumps({
        "error": "REVEYES_API_KEY environment variable is not set.",
        "code": "AUTH_ERROR",
    }))
    sys.exit(1)

client = ReveyesClient(api_key=api_key)

Technical Analysis

The Skill installs reveyes from PyPI without an exact version pin or package hash. The metadata accepts any release at or above version 0.1.2, while the README allows the package manager to select the latest available release.

Python packages can execute code during installation and whenever imported. At runtime, this dependency is also given the REVEYES_API_KEY through ReveyesClient(api_key=api_key) and controls the network implementation used to submit and retrieve review tasks. Because the SDK source is not included in the audited project, its effective behavior cannot be verified from this package.

This does not establish that the current reveyes package is malicious. The vulnerability is the absence of dependency integrity and version controls around a component that executes locally and handles a credential.

Attack Path

  1. An attac ...[truncated 1437 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the SDK to a specifically reviewed version, for example reveyes==X.Y.Z, rather than using a lower-bound constraint.
  2. Generate a lock file containing cryptographic hashes and install with hash verification, such as pip install --require-hashes -r requirements.txt.
  3. Review the pinned package source and confirm its API endpoint, TLS verification, credential handling, telemetry, and transitive dependencies.
  4. Obtain packages only from an explicitly configured trusted index and validate publisher and release provenance where supported.
  5. Use a dedicated, revocable Reveyes API key with the narrowest available permissions, credit limits, and rotation policy.
  6. Run the Skill in an isolated environment with restricted filesystem access and outbound networking limited to the documented Reveyes API endpoints.
  7. Keep the version pin and integrity metadata synchronized between clawhub.json, installation documentation, and deployment automation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README states that the skill fetches reviews via the Reveyes API but does not clearly warn that user-supplied product queries and related metadata are sent to a third-party service. This creates a transparency and data-handling risk: users may disclose proprietary product research, internal target lists, or behavioral context to an external provider without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

Get your key free at www.reveyes.cn → Dashboard → API Keys.

bash
# Add to ~/.zshrc or ~/.bashrc
export REVEYES_API_KEY="your_api_key_here"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This README is a markdown file, so vague-trigger review applies. The description encourages natural free-form requests and provides only example utterances, but it does not clearly state what phrases should or should not invoke the skill, which could lead to overly broad activation from ordinary conversation about Amazon reviews.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares an environment dependency and instructs execution of a local Python script, but it does not declare any explicit tool scope or permissions boundary. That creates ambiguity about what execution and secret access are intended, increasing the risk of over-broad runtime capabilities or accidental secret exposure when the skill is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description does not warn that ASINs, marketplace selections, page counts, and review-query parameters will be transmitted to an external third-party service. This is a real transparency and data-sharing issue: users may unknowingly trigger outbound data transfer to Reveyes, which can violate privacy expectations, enterprise policy, or procurement controls even if the data is not highly sensitive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Natural-language policy review applies to all file types. The README tells users to talk to the agent naturally, but every example invocation is in Chinese and there is no statement that other languages are supported, which can imply a language-specific requirement without offering user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language instructions, usage triggers, and exclusions are written in Chinese, which effectively constrains operation to a specific language context, while no opt-in or explicit locale limitation is provided. The policy requires avoiding forced language/locale behavior unless the user is given a choice or the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code emits Chinese-only error messages in multiple exception paths, which forces a specific language for users rather than offering a choice or matching user preferences. The policy applies to all file types and specifically disallows language/locale forcing without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.