revyl-cli-auth-bypass-android
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user to execute
revylCLI commands (such asrevyl devandrevyl global launch-var) to configure environment variables and initiate testing sessions. These commands are associated with the RevylAI vendor tools. - [PROMPT_INJECTION]: The skill provides instructions for handling external data via Android deep links (
myapp://revyl-auth?...). This represents an indirect prompt injection surface where a malicious link could attempt to manipulate app state. However, the skill provides comprehensive mitigations, including mandatory token validation, environment-based gating (REVYL_AUTH_BYPASS_ENABLED), and strict allowlists for roles and navigation routes. - [SAFE]: The content is standard developer documentation for an automated testing framework. It includes explicit security warnings against shipping bypass logic to production and emphasizes the use of placeholders for sensitive tokens.
Audit Metadata