go-revolut-business

• Outcome: Pass
• Latest audit: Oct 17, 2026 · 5:03 AM UTC
• Version: 0.1.2

Overview

This skill is a straightforward Go API-client guide for Revolut Business, with sensitive token and financial-action risks disclosed and scoped to the stated purpose.

Install only if you intend to let Codex help with Go code that calls the Revolut Business API. Use sandbox while developing, keep REVOLUT_ACCESS_TOKEN out of source control and logs, and require explicit user confirmation before any payment, transfer, exchange, or delete call.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: go-revolut-business
description: Unofficial Go client for the Revolut Business REST API, generated with oapi-codegen. `revolut.NewClientWithResponses(baseURL, opts...)` from `github.com/psyb0t/go-revolut-business` returns a `*revolut.ClientWithResponses` with one typed `<Operation>WithResponse` method per endpoint (accounts, transactions, counterparties, payments, transfers and more). Auth is a bearer access token set through `revolut.WithRequestEditorFn`; responses decode into `JSON200`, `JSON201` and `JSONDefault` fields. Use when Go code needs to call the Revolut Business API or already imports go-revolut-business.
homepage: https://github.com/psyb0t/go-revolut-business
user-invocable: true
metadata:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

---
name: go-revolut-business
description: Unofficial Go client for the Revolut Business REST API, generated with oapi-codegen. `revolut.NewClientWithResponses(baseURL, opts...)` from `github.com/psyb0t/go-revolut-business` returns a `*revolut.ClientWithResponses` with one typed `<Operation>WithResponse` method per endpoint (accounts, transactions, counterparties, payments, transfers and more). Auth is a bearer access token set through `revolut.WithRequestEditorFn`; responses decode into `JSON200`, `JSON201` and `JSONDefault` fields. Use when Go code needs to call the Revolut Business API or already imports go-revolut-business.
homepage: https://github.com/psyb0t/go-revolut-business
user-invocable: true
metadata:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 7)May include surrounding context.

md

- Go 1.26.9 or newer, per the module's `go.mod`.
- Runtime dependencies: `github.com/oapi-codegen/runtime` and `github.com/google/uuid`.
- A Revolut Business API access token.

## Install

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 32)May include surrounding context.

md

## Auth

Every request carries `Authorization: Bearer <access_token>`. Revolut issues the token through OAuth2: a JWT client assertion signed with the private key whose certificate is uploaded in the Business API settings, exchanged together with an authorisation code or refresh token at `/auth/token`. Access tokens expire after 40 minutes.

The module does not implement that flow. Set the token with a `RequestEditorFn` passed as a client option (`revolut.WithRequestEditorFn`), as in the SKILL.md example. A `RequestEditorFn` can also be passed per call as the last arguments of any method. Read the token from the environment; when it expires, the editor can fetch a fresh one from wherever the program keeps it.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This is a markdown file, so SQP-2 applies to missing warnings in the skill description. L34 instructs readers to read an API access token from the environment, but the document does not include any caution that the token is sensitive credential material or guidance to avoid exposing it in logs or shared environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.