revor-company-discovery
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external company data and match reasoning retrieved from the Revor API, which is then presented to the user. This creates a surface for indirect prompt injection if the external data contains malicious instructions.
- Ingestion points: External company profile fields, match status, and criterion reasoning are ingested from the Revor API in
scripts/revor-websets.mjsand passed to the agent. - Boundary markers: The skill instructs the agent to present findings in a structured Markdown table and provides specific constraints on how to derive the 'Why it fits' explanation.
- Capability inventory: The skill has network access to the vendor's API (
revor.ai) and file read/write access to its own configuration file in the user's home directory (~/.config/RevorSkill/.env). - Sanitization: The bundled Node.js client (
scripts/revor-websets.mjs) enforces input length limits on queries and titles, and strictly validates API responses for valid UUIDs, statuses, and match types before processing.
Audit Metadata