Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Reve AI image CLI that sends user-provided prompts and selected images to Reve's API and writes generated output files locally.
Install only if you are comfortable sending prompts and any chosen edit/remix images to Reve's external API. Do not use sensitive, confidential, regulated, or private images or prompts unless that use is approved under your own data-handling requirements.
The skill documentation indicates it uses environment variables for API keys and makes outbound requests to the Reve API, but it does not declare tool scope such as permissions or allowed-tools. That omission weakens transparency and policy enforcement, making it easier for an agent or user to invoke network and secret-accessing behavior without an explicit trust boundary.
The skill description says it generates and edits images via the Reve AI API, but it does not clearly warn that user prompts and uploaded input images are transmitted to a third-party external service. This can lead to inadvertent disclosure of sensitive text or images because users may assume processing is local or may not understand the privacy implications.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bun
/**
* Reve AI Image Generation CLI
* https://api.reve.com/console/docs
*/
import { parseArgs } from "util";
The edit flow reads a local file, base64-encodes it, and sends it as reference_image in a POST request to the Reve API. While the code's purpose is image editing, the user-facing help text does not explicitly disclose that local image contents are uploaded to an external service, which is a privacy-relevant operation for code files under this rule.
The remix flow loads up to six local files and sends their base64 contents as reference_images to the remote /v1/image/remix endpoint. The command help describes inputs and prompt syntax, but it does not clearly warn that user-provided local images are transmitted off-system to a third-party API.
Detected: suspicious.env_credential_access