ClawHub
Back to skill

Security audit

Pub Byterover

Security checks for vulnerabilities and agentic risk

Overview

The skill is a broad external API wrapper that is mostly disclosed, but its branding and scope are inconsistent and it enables sensitive uploads plus email/SMS actions without enough guardrails.

Review this before installing. Use it only if you trust SkillBoss/HeyBossAI with the prompts, files, URLs, audio, contact details, and generated outputs you submit. Avoid sending secrets or regulated data unless you have approval, confirm before using email or SMS actions, and do not run the run.mjs examples unless you know exactly which executable will be invoked.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T07 · Tool Hijacking and Spoofing

Warning
Location
audio-models.md:29
Finding

Unverified run.mjs Command in Audio Model Examples

Content
View full analysis

Vulnerability Details

File Location: audio-models.md:29-32
Vulnerability Type: Unverified local executable resolution
Risk Level: Medium

bash
run.mjs --model elevenlabs/eleven_multilingual_v2 --text "Hello world" --output hello.mp3
run.mjs --model openai/whisper-1 --file recording.m4a
run.mjs --model replicate/meta/musicgen --prompt "upbeat electronic" --duration 30 --output track.mp3

Technical Analysis

The documentation invokes run.mjs as a bare executable name, but the audited project does not contain that file, a package manifest, an installation procedure, a pinned version, an integrity hash, or a trusted source for the command.

The shell must therefore resolve run.mjs from the local environment and PATH. An attacker able to place a malicious executable with that name in a higher-priority directory can cause legitimate-looking model operations to execute attacker-controlled code.

Attack Path

  1. An attacker places a malicious executable named run.mjs in a directory that precedes the legitimate executable in PATH.
  2. An agent or user follows one of the documented audio-model examples.
  3. The shell resolves the attacker-controlled run.mjs.
  4. The malicious process executes with the invoking user's privileges.
  5. It can inspect command arguments, inherited environment variables, and files accessible to that user before optionally imitating the expected model operation.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the user running the command. The process may access inherited environment variables, potentially including SKILLBOSS_API_KEY, and any local files available to the invoking account. It may also alter generated outputs or send submitted audio and prompts to unintended destinations.

Remediation
View remediation

Remediation Suggestions

  • Bundle the reviewed run.mjs implementation in the project and invoke it through a fixed project-relative path.
  • If it is distributed as a dependency, identify the official package, pin an exact version, and commit an integrity-protected lock file.
  • Document the trusted installation source and verify package signatures or cryptographic hashes.
  • Avoid relying on ambiguous bare executable names resolved through PATH.
  • Restrict the subprocess environment to only the variables required for the operation.
  • Add validation that the resolved executable is the expected file before invocation.

T07 · Tool Hijacking and Spoofing

Warning
Location
chat-models.md:31
Finding

Unverified run.mjs Command in Chat Model Examples

Content
View full analysis

Vulnerability Details

File Location: chat-models.md:31-34
Vulnerability Type: Unverified local executable resolution
Risk Level: Medium

bash
run.mjs --model bedrock/claude-4-5-sonnet --prompt "Explain quantum computing"
run.mjs --model openai/gpt-4o-mini --prompt "Summarize this" --context "Be concise"

Technical Analysis

The examples execute run.mjs without supplying or identifying the implementation. Because no such file or pinned dependency exists in the project, command resolution depends on the host's PATH. This permits an attacker-controlled executable with the same name to impersonate the expected tool.

Chat prompts and context are passed directly as command-line arguments, making them visible to the invoked process. A spoofed implementation could collect that content and access inherited credentials.

Attack Path

  1. An attacker introduces a malicious run.mjs into a PATH-preferred directory.
  2. An agent follows a documented chat-model command.
  3. The shell executes the malicious file instead of the intended model client.
  4. The executable captures the prompt, context, and inherited environment.
  5. It performs arbitrary actions under the invoking account or returns fabricated output to conceal the compromise.

Impact Assessment

Exploitation can lead to arbitrary code execution under the invoking user's account, disclosure of prompts and context, theft of inherited API credentials, modification of accessible files, and falsification of model responses. It does not inherently grant privileges beyond those already held by the invoking user.

Remediation
View remediation

Remediation Suggestions

  • Include a reviewed model client in the project and invoke it using an explicit relative or absolute path.
  • Alternatively, specify a trusted package with an exact version and integrity-locked dependency metadata.
  • Verify the executable's resolved path and cryptographic digest before execution.
  • Pass sensitive prompts through standard input or a protected temporary input mechanism rather than command-line arguments where practical.
  • Minimize the environment inherited by the model client and narrowly scope the API credential.

T07 · Tool Hijacking and Spoofing

Warning
Location
image-models.md:22
Finding

Unverified run.mjs Command in Image Model Examples

Content
View full analysis

Vulnerability Details

File Location: image-models.md:22-25
Vulnerability Type: Unverified local executable resolution
Risk Level: Medium

bash
run.mjs --model mm/img --prompt "A sunset over mountains" --output sunset.png
run.mjs --model vertex/gemini-3-pro-image-preview --prompt "A cat" --output cat.png

Technical Analysis

The image examples rely on an absent and undocumented run.mjs executable. Since the command is not bound to a reviewed project file or integrity-pinned package, the operating system resolves it through PATH. A malicious file using the expected name can therefore spoof the client and receive all command arguments.

The command also specifies output paths. A malicious replacement can ignore those paths, overwrite other accessible content, or create deceptive output while performing unrelated operations.

Attack Path

  1. An attacker places a malicious run.mjs in a directory with higher PATH precedence.
  2. The user or agent runs a documented image-generation example.
  3. The shell launches the spoofed executable.
  4. The executable gains access to the prompt, output path, inherited environment, and the invoking user's filesystem permissions.
  5. It steals information, modifies files, or presents a plausible image result to evade detection.

Impact Assessment

The vulnerability can provide arbitrary code execution with the invoking user's privileges. Potential consequences include theft of SKILLBOSS_API_KEY, prompt disclosure, modification or replacement of generated images, and unauthorized access to files readable or writable by that user.

Remediation
View remediation

Remediation Suggestions

  • Ship the expected run.mjs implementation with the Skill and invoke it by a fixed project-relative path.
  • Pin all transitive dependencies and preserve integrity metadata in a lock file.
  • Document the executable's provenance and supported version.
  • Verify the resolved executable before use and reject unexpected paths.
  • Run the client with minimum filesystem permissions and a narrowly scoped environment.
  • Refuse to overwrite existing output files unless the user explicitly approves it.

T07 · Tool Hijacking and Spoofing

Warning
Location
video-models.md:9
Finding

Unverified run.mjs Command in Video Model Examples

Content
View full analysis

Vulnerability Details

File Location: video-models.md:9-12
Vulnerability Type: Unverified local executable resolution
Risk Level: Medium

bash
run.mjs --model mm/t2v --prompt "A cat playing" --output video.mp4
run.mjs --model mm/i2v --prompt "Zoom in slowly" --image "https://example.com/photo.jpg" --output video.mp4

Technical Analysis

These examples invoke run.mjs, but the executable is not present or defined anywhere in the audited project. No trusted package, exact version, or integrity verification is provided. Consequently, command execution depends on mutable host configuration and permits local PATH spoofing.

A malicious replacement receives prompts, image URLs, output paths, and inherited environment variables. It can perform arbitrary operations while producing a plausible output file to appear legitimate.

Attack Path

  1. An attacker obtains the ability to write into a directory earlier in the victim's PATH.
  2. The attacker installs a malicious executable named run.mjs.
  3. An agent follows one of the video-generation examples.
  4. The malicious executable runs with the agent's operating-system permissions.
  5. It captures inputs and credentials, modifies local data, or contacts attacker-controlled services.

Impact Assessment

Exploitation permits arbitrary code execution within the invoking user's privilege boundary. Exposed data may include the SkillBoss API key, submitted prompts, source-image URLs, and accessible local files. Generated video output can also be substituted or corrupted.

Remediation
View remediation

Remediation Suggestions

  • Provide the actual reviewed executable in the repository and reference it through an explicit path.
  • If the executable is external, identify its authoritative source, pin its exact version, and verify its integrity.
  • Do not instruct agents to invoke an unspecified bare command.
  • Limit inherited credentials and filesystem permissions.
  • Validate input URLs and output destinations inside the trusted implementation.
  • Add installation and verification instructions so users can confirm which program will execute.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:74
Finding

Unvalidated Remote URL Used for Redirect-Following File Download

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:74-80
Vulnerability Type: Unvalidated remote URL and unsafe output handling
Risk Level: Low

bash
URL=$(curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \
  | jq -r '.image_url // .result.image_url // .data[0]')
curl -sL "$URL" -o sunset.png

Technical Analysis

The download URL is taken directly from a remote API response and passed to curl -L without validating its scheme, hostname, response status, content type, or expected size. Redirects are followed automatically. The fixed output name is also overwritten without checking whether the file already exists.

If the API, an upstream provider, or a response-processing path is compromised, it can return an unexpected URL or redirect chain. The client will retrieve that resource from the local execution environment. The example does not execute the downloaded file, which limits direct code-execution impact, but it can still retrieve unintended content, consume excessive storage or bandwidth, and replace a local file.

Attack Path

  1. An attacker compromises or influences the API response that supplies image_url, result.image_url, or data[0].
  2. The response contains an unexpected URL or a URL that redirects to an unintended resource.
  3. curl -L follows the supplied location without host or protocol restrictions.
  4. The returned content is written to sunset.png, replacing any existing file with that name.
  5. An oversized or deceptive response can consume resources or mislead downstream processing.

Impact Assessment

The issue can cause unintended outbound requests, download attacker-selected content, consume local disk space or network bandwidth, and overwrite sunset.png within the current working directory. No ...[truncated 127 chars]

Remediation
View remediation

Remediation Suggestions

  • Parse and validate the API response before initiating a download.
  • Permit only HTTPS URLs and restrict destination hosts to an explicit trusted allowlist.
  • Use curl --fail --show-error --proto '=https' and restrict redirects to HTTPS.
  • Reject null, empty, malformed, or unexpectedly structured URL values.
  • Enforce response-size and timeout limits where supported.
  • Verify the returned content type and, when available, a server-provided cryptographic digest.
  • Write to a securely created new file and avoid overwriting an existing path without explicit approval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (32)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill encourages sending prompts, documents, audio, URLs, and search queries to external APIs across chat, document parsing, speech, and scraping workflows without any privacy or data-handling warning. In an agent workflow, users may reasonably assume these are local transformations, leading to unintentional disclosure of sensitive content to third-party services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

Document processing can transmit potentially sensitive files or document URLs to an external service for parsing/extraction, and the skill provides no warning or approval guidance. In an agent context, this is materially risky because users may upload proprietary or regulated documents without understanding they are leaving the environment.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Document Processing

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.