rei

SAFE max severity MEDIUMSkillSpector Caution 9 registry clawhub.ai last scanned 2026-02-07 1 scan

Verdict safe, but 2 findings (2 medium), mainly data exfiltration, command injection. Most recent scan 2026-02-07.

The 'rei' skill is a configuration utility for adding the Rei Qwen3 Coder model provider to Clawdbot. The skill presents MEDIUM security risks primarily related to credential handling and input validation. The main concerns are: (1) API keys stored in plaintext in backup files without proper protection, (2) potential command injection through unsanitized API key input, and (3) inadequate error handling that could leave the system in an inconsistent state. The skill does not exhibit malicious behavior such as data exfiltration, prompt injection, or unauthorized tool use. However, the credential management practices need improvement to prevent accidental exposure. The scripts perform legitimate configuration tasks (JSON manipulation, service restart) appropriate for their stated purpose. No deceptive behavior or social engineering was detected - the skill accurately describes its functionality.
Scanner's overall assessment (LLM analyzer)

Findings2

Critical0

High0

Medium2

Low0

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 9

Score9 / 100

Issues1

CategoriesPrivilege Escalation

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Set up Rei Qwen3 Coder as a model provider. Use when configuring coder.reilabs.org, adding Rei to Clawdbot, or troubleshooting 403 errors from Rei endpoints.

Package: 4 files, 4.9 KB
SKILL.md: 219 words, 7 sections
Code: Shell (3)

SKILL.md covers: Rei Qwen3 Coder · Setup via Script · Setup via Agent · Switching Models · Revert · Manual Setup · Troubleshooting

Findings

MEDIUM Hardcoded API Key Exposure in Backup File Data Exfiltrationllm

The setup.sh script creates a backup of the Clawdbot config file (clawdbot.json.bak) that contains the user's API key in plaintext. This backup file persists on disk and could be inadvertently exposed through file sharing, backups, or version control systems. The API key is embedded directly in the JSON configuration without encryption or secure storage mechanisms.

scripts/setup.sh:30

cp "$CONFIG_FILE" "${CONFIG_FILE}.bak"
# Later embeds API key:
"apiKey": "$API_KEY"

Remediation: 1. Warn users that API keys will be stored in plaintext in config files 2. Set restrictive permissions on backup files (chmod 600) 3. Consider using environment variables or secure credential storage instead of embedding keys in config files 4. Add .bak files to .gitignore if version control is used 5. Document secure key management practices in the skill documentation

MEDIUM Command Injection Risk via API Key Input Command Injectionllm

The setup.sh script accepts an API key as a command-line argument or via interactive prompt and embeds it directly into a JSON structure without proper sanitization or escaping. If a malicious API key containing special characters (quotes, backticks, dollar signs) is provided, it could break out of the JSON structure or cause command injection when the jq command processes the configuration. While jq provides some protection, the lack of input validation is a security concern.

scripts/setup.sh

REI_PROVIDER=$(cat <<EOF
{
  "apiKey": "$API_KEY",
  ...
}
EOF
)
jq --argjson rei "$REI_PROVIDER" ...

Remediation: 1. Validate API key format before use (alphanumeric + allowed special chars) 2. Use jq's --arg flag instead of --argjson for string values to ensure proper escaping 3. Sanitize user input by rejecting keys with shell metacharacters 4. Example: jq --arg key "$API_KEY" '.models.providers.rei.apiKey = $key' 5. Add input validation: if [[ ! "$API_KEY" =~ ^[a-zA-Z0-9_-]+$ ]]; then echo "Invalid key format"; exit 1; fi

What is in the package

File	Kind	Size
`SKILL.md`	doc	1.9 KB
`scripts/revert.sh`	script	482 B
`scripts/setup.sh`	script	1.9 KB
`scripts/switch.sh`	script	589 B

External hosts referenced

coder.reilabs.org

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

CONFIG_FILE API_KEY REI_PROVIDER

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/rei
Raw scan result: rei-clawd-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-rei.svg)
Request a re-scan