revenium@0.6.4
VERIFIED· install onlyPublisher claims: "MANDATORY guardrail check BEFORE EVERY OPERATION — read guardrail-status.json first, always, no exceptions. Enforces Revenium guardrails-native budget rules,..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Install scripts ran; no agent task scenario for this bundle.- Tested
- install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-13 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.1sprocessexec /usr/bin/dirname
0.1sprocessexec /usr/bin/uname
0.1sprocessexited 1: ✗ Homebrew is required to auto-install revenium/tap/revenium. Install it from https://brew.sh or install revenium/tap/revenium manually, then re-run this script.
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.1sprocesssecond launch, clock +45 days, CI unset
0.2sprocessexec /usr/bin/dirname
0.2sprocessexec /usr/bin/uname
0.2sprocessexited 1: ✗ Homebrew is required to auto-install revenium/tap/revenium. Install it from https://brew.sh or install revenium/tap/revenium manually, then re-run this script.
Static findings
MEDIUM
File permission modification commandscripts/post-install-nemoclaw.sh:672 · File permission modification command — agent changes file ownership/permissions
AST05…ntf '%s' '${config_b64}' | base64 -d > /sandbox/.config/revenium/config.yaml && chmod 600 /sandbox/.config/revenium/config.yaml" ledger_set "creds-written" "1" …Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commandscripts/probe-host-compat.sh:14 · Privileged sudo command — agent may execute with elevated privileges
AST05# - Optional NVIDIA GPU passthrough via: sudo nvidia-ctk runtime configure --runtime=dockerFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandscripts/install-cron.sh:87 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${SKILL_DIR}/scripts/report.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/post-install-nemoclaw.sh:628 · File permission modification command — agent changes file ownership/permissions
AST05# chmod 600. API key MUST NOT appear on a nemoclaw exec command line (D-05, T-13-KEY).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commandscripts/post-install.sh:71 · Privileged sudo command — agent may execute with elevated privileges
AST05warn "no usable rootless bwrap — installing ${formula} with HOMEBREW_NO_SANDBOX_LINUX=1 (to restore brew's build sandbox later: sudo apt-get install -y bubblewrap)"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandplugin-nemoclaw/src/index.test.js:456 · File permission modification command — agent changes file ownership/permissions
AST05// Make the tmp state dir unwritable (skip on root or platforms where chmod has no effect)Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/post-install.sh:206 · File permission modification command — agent changes file ownership/permissions
AST05chmod 700 "${SKILL_DIR}/markers"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandtests/test_nemoclaw_provisioning.sh:835 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${bindir}/curl" "${bindir}/sha256sum"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/install-cron.sh:88 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${SKILL_DIR}/scripts/cron.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedtests/test_get_root_session_id.py:129 · Python subprocess execution detected
AST05proc = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandtests/test_setup_guardrails_argv.sh:147 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${STUB_BIN}/revenium"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandtests/test_nemoclaw_cron.sh:434 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${TMP_HOME_F}/.local/bin/apt-get" "${TMP_HOME_F}/.local/bin/dnf"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/install-nemoclaw-cron.sh:110 · File permission modification command — agent changes file ownership/permissions
AST05# chmod 600 immediately. Key must NOT appear in the crontab line or logs.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandtests/test_nemoclaw_provisioning.sh:100 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${d}/stub-probe-host-compat.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandplugin/src/index.test.js:401 · File permission modification command — agent changes file ownership/permissions
AST05// Make the tmp state dir unwritable (skip on root or platforms where chmod has no effect)Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/install-nemoclaw-cron.sh:121 · File permission modification command — agent changes file ownership/permissions
AST05chmod 600 "${HOST_ENV_FILE}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandtests/test_guardrail_argv.sh:523 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${TMP_METER_FAIL_BIN}/revenium"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandtests/test_nemoclaw_provisioning.sh:816 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${_fix_dir}/revenium"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/post-install.sh:165 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${SKILL_DIR}/scripts/${script}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandtests/test_nemoclaw_provisioning.sh:849 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "${TMP_HOME_La}/.local/bin/revenium"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.Cost to the agent
Instructions loaded
≈6,208 tok
2 files · 74 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.