Reve AI Image Generation

PassAudited by ClawScan on May 10, 2026.

Overview

The skill appears to do what it says—generate, edit, and remix images with Reve AI—but it uses a Reve API key and uploads selected input images to Reve.

This skill is reasonable to install if you intend to use Reve AI. Before using it, set a dedicated Reve API key, expect API credit usage, and avoid sending private or sensitive images unless you are comfortable with Reve processing them.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Invoking the skill can use the configured Reve account and spend API credits.

Why it was flagged

The skill uses a Reve API key from the environment to authenticate API calls. This is expected for the stated service, but it gives the skill access to act against that Reve account and consume credits.

Skill content

const key = process.env.REVE_API_KEY || process.env.REVE_AI_API_KEY; ... "Authorization": `Bearer ${getApiKey()}`

Recommendation

Use a Reve-specific, revocable API key and only expose it in environments where you intend this skill to run.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Any image selected with the input option is uploaded to Reve for processing.

Why it was flagged

For edit and remix operations, the script base64-encodes the user-provided image files and includes them in requests to the external Reve API.

Skill content

reference_image: loadImageBase64(values.input), ... reference_images: inputs.map(loadImageBase64)

Recommendation

Only provide images you are comfortable sending to Reve, and verify input paths before running edit or remix commands.