Security audit

revolut

Security checks across malware telemetry and agentic risk

Overview

This Revolut automation skill is mostly purpose-aligned, but it handles banking sessions and an optional app PIN in ways users should review carefully before installing.

Install only if you are comfortable letting this skill automate an authenticated Revolut web session. Avoid storing a PIN in config.json, run it in a private workspace, keep exported JSON files out of shared folders and backups, use logout after each session, and treat workspace/revolut as containing sensitive banking session data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation exposes capabilities to read configuration, write output files, persist browser session state, and access the network, but the manifest does not declare corresponding permissions. In a banking automation context, undeclared file, environment, and network access reduces transparency and reviewability, making it easier for sensitive financial data or session artifacts to be handled in ways operators did not explicitly approve.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims a narrower scope than the behavior described by analysis and the documentation, omitting investment portfolio access, investment transaction retrieval, synthetic account generation, and a debug-style invest endpoint scan. For a financial automation skill, this mismatch is dangerous because users may authorize account access expecting only basic banking operations while the skill can reach additional sensitive data domains and expose internal API surface area.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The implemented functionality exceeds the stated skill scope by adding portfolio and investment-transaction retrieval, which broadens access to more sensitive financial data than a user or reviewer would expect from the manifest. This is dangerous because scope mismatch undermines informed consent and can lead to unauthorized collection of investment holdings and trade history under the guise of simpler account/transaction automation.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The invest-scan command enumerates internal Revolut Invest API endpoints, which goes beyond ordinary account automation and can facilitate service reconnaissance. In a financial automation skill, that increases the risk of exposing undocumented endpoints, expanding attack surface knowledge, and enabling later misuse by operators or downstream tooling.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The setup instructions explicitly show storing a 6-digit Revolut app PIN in plaintext inside a local JSON config file, with no warning about treating it as sensitive or restricting file permissions. Because this skill automates access to a financial account, exposing the PIN increases the chance of credential theft from disk, backups, logs, screenshots, or shared workspaces, enabling unauthorized account access when combined with other login factors.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script persists Playwright storage state to disk, which can contain session cookies and other authentication artifacts sufficient to reuse an authenticated Revolut session. Without a prominent warning, strict file permissions, encryption, and lifecycle controls, local compromise or accidental exposure of these files could lead to account takeover or unauthorized financial-data access.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script reads a PIN from local configuration and automatically types it into the site, meaning a sensitive authentication factor is stored in plaintext-like application config and used non-interactively. In a banking context this is especially risky because compromise of the workspace or config file could expose credentials that enable stronger account access or help bypass step-up authentication.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.