Skills
Navigate
skills/revylai/revyl-cli/revyl-cli-auth-bypass-flutter/Gen Agent Trust Hub

revyl-cli-auth-bypass-flutter

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to utilize various revyl CLI tools for environment setup and verification, including revyl global launch-var, revyl dev, revyl device navigate, and revyl device screenshot. These commands are standard operations within the author's specified ecosystem.
  • [PROMPT_INJECTION]: The skill defines a mechanism that processes external data from deep links, creating a potential attack surface for indirect prompt injection.
  • Ingestion points: Data enters the system via URI query parameters (token, role, redirect) within the handleRevylAuthBypass function described in SKILL.md.
  • Boundary markers: No explicit markers or instructions are provided to the agent to distinguish between data and potential instructions within the URI content.
  • Capability inventory: The skill enables capabilities such as navigating to specific URLs and taking device screenshots via the revyl CLI.
  • Sanitization: The provided implementation includes validation logic that checks the role and redirect parameters against predefined allowlists, and verifies the token against a value fetched from the platform's launch configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 10:12 PM
Security Audit — agent-trust-hub — revyl-cli-auth-bypass-flutter