Reah Skill: Agent Card

Retrieve masked card info from Reah using an access key. Handles session generation, secure fetch, and decryption for agents automatically.

This skill appears to implement the described Reah card access flow and keeps network activity constrained to agents.reah.com, but there are a few things to verify before installing: - Confirm provenance: the registry lists the source as unknown and SKILL.md/README point to a GitHub install; verify the skill's origin (official Reah repo) before adding it to an agent that will handle card keys. - Metadata mismatch: SKILL.md requires REAH_AGENT_KEYS but the registry metadata you saw did not declare this — ask the publisher to correct the manifest so required env vars are explicit. - Review the confirmation flow: SKILL.md requires an explicit per-read confirmation for REAH_AGENT_KEYS. Ensure your agent platform actually prompts and prevents silent env reads. - Least privilege: store REAH_AGENT_KEYS only where necessary, rotate keys regularly as advised, and prefer short-lived keys if Reah supports them. - Code audit: the included Node example decrypts sensitive material in memory (but doesn't print it). If you plan to enable autonomous use, audit how the agent will use decrypted values and ensure it will only return masked/redacted card parts as specified. If you cannot verify the skill's source or guarantee the per-read confirmation behavior, treat this skill as higher risk and avoid installing it in environments with real card keys.

Type: OpenClaw Skill Name: reah-agent-card Version: 1.0.3 The skill bundle is a legitimate integration for the Reah platform, allowing an AI agent to securely retrieve virtual card information. It features robust security controls, including mandatory manual user confirmation for every access key read, strict masking/redaction requirements for card data in user-facing responses, and a hardcoded GraphQL endpoint (https://agents.reah.com/graphql) to prevent redirection. The accompanying Node.js script (get-card-info-example.mjs) implements a secure end-to-end encryption flow using RSA-OAEP for session establishment and AES-GCM for data decryption, with no evidence of unauthorized data exfiltration or malicious intent.