revor-contact-search
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided company domains and positions which are then used in API requests and research tasks.\n
- Ingestion points: User-provided domain and positions are ingested via
SKILL.mdinstructions and passed to the execution script inscripts/revor-contacts.mjs.\n - Boundary markers: The instructions lack explicit boundary markers or specific directives to ignore instructions potentially embedded in the data returned from the Revor API.\n
- Capability inventory: The skill uses a Node.js script to perform network requests (
fetch) to the Revor API and reads/writes local configuration files (.env).\n - Sanitization: While the script performs basic validation of command-line arguments, it does not explicitly sanitize the results received from the external API before presenting them to the user.
Audit Metadata