revor-company-discovery

This CLI implements a Revor API client and shows no clear evidence of malware. Its main security concern is that an arbitrary REVOR_BASE_URL from the environment or .env files receives the REVOR_API_KEY bearer token, including over plain HTTP if configured that way. The default host is https://revor[.]ai, and the credential may be read from ~/.config/RevorSkill/.env or the skill-local .env. Overall risk is moderate and depends on trust in the configured API host.