revor-outreach

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill enforces a mandatory human-in-the-loop workflow by requiring explicit user confirmation for all outreach dispatches. It specifically instructs the agent to draft content first and only send once the user provides clear approval.
  • [SAFE]: Credential management for the REVOR_API_KEY is handled through standard local environment files located at ~/.config/RevorSkill/.env. The skill includes specific safeguards to prevent the leaking of these secrets, such as masking keys in output and prohibiting storage in logs or memory files.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a potential attack surface because it processes external recipient data and user-provided context to generate messages.
  • Ingestion points: The agent ingests recipient contact details (profile URLs, email addresses) and user-defined objectives from the chat context (SKILL.md).
  • Boundary markers: The instructions explicitly demand a 'draft-only' phase and forbid the fabrication of contact data (SKILL.md).
  • Capability inventory: The skill uses MCP tools and REST API calls to revor.ai to dispatch messages and like LinkedIn posts (reference/dispatch/dispatch.md).
  • Sanitization: The skill validates the can_send status of accounts and verifies that channel-specific required fields are present before execution (reference/accounts.md).
  • [SAFE]: The skill performs legitimate network operations to the vendor's domain (revor.ai) to check account readiness and execute dispatch jobs as intended by the primary functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 05:16 AM
Security Audit — agent-trust-hub — revor-outreach