revyl-cli-auth-bypass-expo
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to use the
revylCLI tool for environment management and device automation. This includes creating launch variables (revyl global launch-var), starting development loops (revyl dev), and triggering device navigation (revyl device navigate). These commands are part of the vendor's intended development workflow. - [EXTERNAL_DOWNLOADS]: The skill references and installs additional skills (
revyl-cli-auth-bypass,revyl-cli-dev-loop) using the vendor-providedrevyl skill installcommand. These resources originate from the same vendor (RevylAI) and are standard components of the toolset. - [CREDENTIALS_UNSAFE]: The skill provides a mechanism for handling authentication tokens during testing. It follows security best practices by using placeholders (
<test-only-token>), advising against committing real credentials to version control, and utilizing local environment variables (launch variables) for state management. - [COMMAND_EXECUTION]: The provided React Native code snippet processes external data from deep links (
myapp://revyl-auth?...). The implementation includes several security guardrails: it validates the token against a server-provided environment variable, uses an allowlist for user roles, and strictly validates redirect paths against a predefined map to prevent open-redirect vulnerabilities.
Audit Metadata