Security audit
Security checks for vulnerabilities and agentic risk
This skill is presented as Sonos-related but mainly enables a broad external AI gateway, including email and SMS actions, so it should go through Review before use.
Install only if you intend to use SkillBoss as a broad third-party AI and communications API, not merely a Sonos controller. Review any agent action before it sends documents, audio, prompts, email, SMS, phone numbers, or verification codes through the SkillBoss API, and consider using a narrower skill for Sonos-only control.
The skill is labeled and described as a Sonos speaker control tool, but the body exposes a broad third-party AI and communications gateway with unrelated capabilities. This kind of capability mismatch is dangerous because it defeats user and platform trust assumptions and can smuggle in powerful outbound functions under an innocuous name.
Email sending and SMS/OTP operations are high-risk outbound actions that are unrelated to Sonos control and enable real-world messaging to arbitrary recipients. In the context of a mislabeled skill, these functions materially increase abuse potential for spam, phishing support, account-verification abuse, or covert data exfiltration.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`
## List Models
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://api.heybossai.com/v1/models \
-H "Authorization: Bearer $SKILLBOSS_API_KEY"
The skill includes broad chat, image, video, TTS, STT, music, document parsing, and web-search functions that do not match the stated Sonos-control purpose. This excessive scope increases attack surface and creates opportunities to transmit user data to external services under misleading expectations.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Authorization: Bearer $SKILLBOSS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Authorization: Bearer $SKILLBOSS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Authorization: Bearer $SKILLBOSS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Authorization: Bearer $SKILLBOSS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
No suspicious patterns detected.