Reveal Reviewer skills

PassAudited by ClawScan on May 10, 2026.

Overview

The visible artifacts describe a coherent Reveal review assistant that uses a Reveal API key, browser automation, screenshots, and API submissions as part of its stated purpose.

This skill appears purpose-aligned for Reveal product reviews. Before installing, make sure you trust the agent-browser dependency, keep your Reveal API key private, and avoid capturing or submitting screenshots of sensitive information.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may browse websites, interact with pages, and submit review results to Reveal on the user's behalf.

Why it was flagged

The skill directs browser automation and external API submission. This is central to product-review work, but it can interact with third-party sites and mutate the user's Reveal account.

Skill content
Use the `agent-browser` skill to: ... Navigate to the task's `website` URL ... Try to interact with elements as instructed ... POST `/submissions`
Recommendation

Use it only for review tasks you intend to complete, and review the structured findings before allowing final submission.

What this means

Anyone or any agent process with this key can act through the Reveal reviewer API within that key's permissions.

Why it was flagged

The skill requires a Reveal reviewer API key and uses it as a bearer token for all API calls. This is expected for the service integration.

Skill content
`REVEAL_REVIEWER_API_KEY` environment variable ... Authorization: Bearer $REVEAL_REVIEWER_API_KEY
Recommendation

Store the API key securely, rotate it if exposed, and avoid sharing it outside the intended OpenClaw environment.

What this means

The actual website navigation and screenshot behavior depends on the separately installed agent-browser skill.

Why it was flagged

The skill relies on a separate browser automation skill that is not part of these artifacts. The dependency is disclosed and purpose-aligned.

Skill content
Requires agent-browser skill for website navigation ... If not installed: `clawhub install TheSethRose/agent-browser`
Recommendation

Review and install the browser dependency only from a trusted source before using this skill.

What this means

Screenshots or notes may reveal information visible during the review session.

Why it was flagged

The API reference documents sending findings, screenshots, notes, and optional videos to Reveal. This is expected for reviews but can include sensitive page content.

Skill content
"findings": { ... }, "screenshots": ["https://...png"], "notes": "Optional notes", "videoUrl": "https://...mp4"
Recommendation

Avoid reviewing pages that contain private data, credentials, personal information, or confidential business content unless you intend to share that evidence with Reveal.