Pub Byterover

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:46 PM UTC
• Version: 1.0.0

Overview

The skill is a broad external API wrapper that is mostly disclosed, but its branding and scope are inconsistent and it enables sensitive uploads plus email/SMS actions without enough guardrails.

Review this before installing. Use it only if you trust SkillBoss/HeyBossAI with the prompts, files, URLs, audio, contact details, and generated outputs you submit. Avoid sending secrets or regulated data unless you have approval, confirm before using email or SMS actions, and do not run the run.mjs examples unless you know exactly which executable will be invoked.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T07 · Tool Hijacking and Spoofing

Warning

• Location: audio-models.md:29
• Finding: Unverified run.mjs Command in Audio Model Examples## Vulnerability Details **File Location**: `audio-models.md:29-32` **Vulnerability Type**: Unverified local executable resolution **Risk Level**: Medium ```bash run.mjs --model elevenlabs/eleven_multilingual_v2 --text "Hello world" --output hello.mp3 run.mjs --model openai/whisper-1 --file recording.m4a run.mjs --model replicate/meta/musicgen --prompt "upbeat electronic" --duration 30 --output track.mp3 ``` ### Technical Analysis The documentation invokes `run.mjs` as a bare executable name, but the audited project does not contain that file, a package manifest, an installation procedure, a pinned version, an integrity hash, or a trusted source for the command. The shell must therefore resolve `run.mjs` from the local environment and `PATH`. An attacker able to place a malicious executable with that name in a higher-priority directory can cause legitimate-looking model operations to execute attacker-controlled code. ### Attack Path 1. An attacker places a malicious executable named `run.mjs` in a directory that precedes the legitimate executable in `PATH`. 2. An agent or user follows one of the documented audio-model examples. 3. The shell resolves the attacker-controlled `run.mjs`. 4. The malicious process executes with the invoking user's privileges. 5. It can inspect command arguments, inherited environment variables, and files accessible to that user before optionally imitating the expected model operation. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the user running the command. The process may access inherited environment variables, potentially including `SKILLBOSS_API_KEY`, and any local files available to the invoking account. It may also alter generated outputs or send submitted audio and prompts to unintended destinations.
• Remediation: ## Remediation Suggestions - Bundle the reviewed `run.mjs` implementation in the project and invoke it through a fixed project-relative path. - If it is distributed as a dependency, identify the official package, pin an exact version, and commit an integrity-protected lock file. - Document the trusted installation source and verify package signatures or cryptographic hashes. - Avoid relying on ambiguous bare executable names resolved through `PATH`. - Restrict the subprocess environment to only the variables required for the operation. - Add validation that the resolved executable is the expected file before invocation.

T07 · Tool Hijacking and Spoofing

Warning

• Location: chat-models.md:31
• Finding: Unverified run.mjs Command in Chat Model Examples## Vulnerability Details **File Location**: `chat-models.md:31-34` **Vulnerability Type**: Unverified local executable resolution **Risk Level**: Medium ```bash run.mjs --model bedrock/claude-4-5-sonnet --prompt "Explain quantum computing" run.mjs --model openai/gpt-4o-mini --prompt "Summarize this" --context "Be concise" ``` ### Technical Analysis The examples execute `run.mjs` without supplying or identifying the implementation. Because no such file or pinned dependency exists in the project, command resolution depends on the host's `PATH`. This permits an attacker-controlled executable with the same name to impersonate the expected tool. Chat prompts and context are passed directly as command-line arguments, making them visible to the invoked process. A spoofed implementation could collect that content and access inherited credentials. ### Attack Path 1. An attacker introduces a malicious `run.mjs` into a PATH-preferred directory. 2. An agent follows a documented chat-model command. 3. The shell executes the malicious file instead of the intended model client. 4. The executable captures the prompt, context, and inherited environment. 5. It performs arbitrary actions under the invoking account or returns fabricated output to conceal the compromise. ### Impact Assessment Exploitation can lead to arbitrary code execution under the invoking user's account, disclosure of prompts and context, theft of inherited API credentials, modification of accessible files, and falsification of model responses. It does not inherently grant privileges beyond those already held by the invoking user.
• Remediation: ## Remediation Suggestions - Include a reviewed model client in the project and invoke it using an explicit relative or absolute path. - Alternatively, specify a trusted package with an exact version and integrity-locked dependency metadata. - Verify the executable's resolved path and cryptographic digest before execution. - Pass sensitive prompts through standard input or a protected temporary input mechanism rather than command-line arguments where practical. - Minimize the environment inherited by the model client and narrowly scope the API credential.

T07 · Tool Hijacking and Spoofing

Warning

• Location: image-models.md:22
• Finding: Unverified run.mjs Command in Image Model Examples## Vulnerability Details **File Location**: `image-models.md:22-25` **Vulnerability Type**: Unverified local executable resolution **Risk Level**: Medium ```bash run.mjs --model mm/img --prompt "A sunset over mountains" --output sunset.png run.mjs --model vertex/gemini-3-pro-image-preview --prompt "A cat" --output cat.png ``` ### Technical Analysis The image examples rely on an absent and undocumented `run.mjs` executable. Since the command is not bound to a reviewed project file or integrity-pinned package, the operating system resolves it through `PATH`. A malicious file using the expected name can therefore spoof the client and receive all command arguments. The command also specifies output paths. A malicious replacement can ignore those paths, overwrite other accessible content, or create deceptive output while performing unrelated operations. ### Attack Path 1. An attacker places a malicious `run.mjs` in a directory with higher PATH precedence. 2. The user or agent runs a documented image-generation example. 3. The shell launches the spoofed executable. 4. The executable gains access to the prompt, output path, inherited environment, and the invoking user's filesystem permissions. 5. It steals information, modifies files, or presents a plausible image result to evade detection. ### Impact Assessment The vulnerability can provide arbitrary code execution with the invoking user's privileges. Potential consequences include theft of `SKILLBOSS_API_KEY`, prompt disclosure, modification or replacement of generated images, and unauthorized access to files readable or writable by that user.
• Remediation: ## Remediation Suggestions - Ship the expected `run.mjs` implementation with the Skill and invoke it by a fixed project-relative path. - Pin all transitive dependencies and preserve integrity metadata in a lock file. - Document the executable's provenance and supported version. - Verify the resolved executable before use and reject unexpected paths. - Run the client with minimum filesystem permissions and a narrowly scoped environment. - Refuse to overwrite existing output files unless the user explicitly approves it.

T07 · Tool Hijacking and Spoofing

Warning

• Location: video-models.md:9
• Finding: Unverified run.mjs Command in Video Model Examples## Vulnerability Details **File Location**: `video-models.md:9-12` **Vulnerability Type**: Unverified local executable resolution **Risk Level**: Medium ```bash run.mjs --model mm/t2v --prompt "A cat playing" --output video.mp4 run.mjs --model mm/i2v --prompt "Zoom in slowly" --image "https://example.com/photo.jpg" --output video.mp4 ``` ### Technical Analysis These examples invoke `run.mjs`, but the executable is not present or defined anywhere in the audited project. No trusted package, exact version, or integrity verification is provided. Consequently, command execution depends on mutable host configuration and permits local PATH spoofing. A malicious replacement receives prompts, image URLs, output paths, and inherited environment variables. It can perform arbitrary operations while producing a plausible output file to appear legitimate. ### Attack Path 1. An attacker obtains the ability to write into a directory earlier in the victim's `PATH`. 2. The attacker installs a malicious executable named `run.mjs`. 3. An agent follows one of the video-generation examples. 4. The malicious executable runs with the agent's operating-system permissions. 5. It captures inputs and credentials, modifies local data, or contacts attacker-controlled services. ### Impact Assessment Exploitation permits arbitrary code execution within the invoking user's privilege boundary. Exposed data may include the SkillBoss API key, submitted prompts, source-image URLs, and accessible local files. Generated video output can also be substituted or corrupted.
• Remediation: ## Remediation Suggestions - Provide the actual reviewed executable in the repository and reference it through an explicit path. - If the executable is external, identify its authoritative source, pin its exact version, and verify its integrity. - Do not instruct agents to invoke an unspecified bare command. - Limit inherited credentials and filesystem permissions. - Validate input URLs and output destinations inside the trusted implementation. - Add installation and verification instructions so users can confirm which program will execute.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:74
• Finding: Unvalidated Remote URL Used for Redirect-Following File Download## Vulnerability Details **File Location**: `SKILL.md:74-80` **Vulnerability Type**: Unvalidated remote URL and unsafe output handling **Risk Level**: Low ```bash URL=$(curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \ | jq -r '.image_url // .result.image_url // .data[0]') curl -sL "$URL" -o sunset.png ``` ### Technical Analysis The download URL is taken directly from a remote API response and passed to `curl -L` without validating its scheme, hostname, response status, content type, or expected size. Redirects are followed automatically. The fixed output name is also overwritten without checking whether the file already exists. If the API, an upstream provider, or a response-processing path is compromised, it can return an unexpected URL or redirect chain. The client will retrieve that resource from the local execution environment. The example does not execute the downloaded file, which limits direct code-execution impact, but it can still retrieve unintended content, consume excessive storage or bandwidth, and replace a local file. ### Attack Path 1. An attacker compromises or influences the API response that supplies `image_url`, `result.image_url`, or `data[0]`. 2. The response contains an unexpected URL or a URL that redirects to an unintended resource. 3. `curl -L` follows the supplied location without host or protocol restrictions. 4. The returned content is written to `sunset.png`, replacing any existing file with that name. 5. An oversized or deceptive response can consume resources or mislead downstream processing. ### Impact Assessment The issue can cause unintended outbound requests, download attacker-selected content, consume local disk space or network bandwidth, and overwrite `sunset.png` within the current working directory. No ...[truncated 127 chars]
• Remediation: ## Remediation Suggestions - Parse and validate the API response before initiating a download. - Permit only HTTPS URLs and restrict destination hosts to an explicit trusted allowlist. - Use `curl --fail --show-error --proto '=https'` and restrict redirects to HTTPS. - Reject null, empty, malformed, or unexpectedly structured URL values. - Enforce response-size and timeout limits where supported. - Verify the returned content type and, when available, a server-provided cryptographic digest. - Write to a securely created new file and avoid overwriting an existing path without explicit approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (32)

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## List Models

```bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill encourages sending prompts, documents, audio, URLs, and search queries to external APIs across chat, document parsing, speech, and scraping workflows without any privacy or data-handling warning. In an agent workflow, users may reasonably assume these are local transformations, leading to unintentional disclosure of sensitive content to third-party services.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Image Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Video Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Text-to-Speech

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Text-to-Speech

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Speech-to-Text

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Background Removal

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Document Processing

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: Document processing can transmit potentially sensitive files or document URLs to an external service for parsing/extraction, and the skill provides no warning or approval guidance. In an agent context, this is materially risky because users may upload proprietary or regulated documents without understanding they are leaving the environment.

Static analysis

No suspicious patterns detected.