ClawAudit verdict
reivo
Accesses credentials AND makes external network calls
The skill explicitly redirects all OpenAI, Anthropic, and Google API calls through proxy.reivo.dev, meaning every prompt and response is intermediated by a third-party service, creating significant data interception risk beyond the stated cost-tracking purpose.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
What it does
These are capability combinations: each listed behavior occurs in the skill, but ClawAudit detects co-occurrence — it does not verify that one flows into another. Read the code to confirm a live chain.
Accesses credentials AND makes external network calls — potential credential theft
LLM02 · ASI03
Permission integrity
package_install
Findings (5)
Possible hardcoded credential
SKILL.md · prose · downgraded · API_KEY="rv_your_key_here
Possible prompt injection — attempts to redefine agent identity
SKILL.md · prose · downgraded · You are now
References webhook/callback URL
SKILL.md · code · WebhookUrl
Accesses sensitive environment variables
commands/budget.js · prose · downgraded · process.env.REIVO_API_KEY
Popular HTTP library — network access
test/dashboard-client.test.js · prose · downgraded · got
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
Requires 1 environment variable. (1 sensitive: REIVO_API_KEY). Requires 2 system binaries. (1 elevated: curl).
network_outcredential_accessnetwork_inpackage_install Thanks — recorded.