Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Keevx image-to-video API guide; it sends user-selected images and prompts to Keevx as part of its stated purpose.
Install only if you are comfortable sending selected images, prompts, and generated-media requests to Keevx using your Keevx API key. Keep the key in an environment variable or secrets manager, do not hardcode or share it, and avoid uploading sensitive, private, proprietary, or unauthorized images unless Keevx's handling and retention terms are acceptable for your use.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoints
- Base URL: `https://api.keevx.com/v1`
- Upload image: `POST /figure-resource/upload/file` (Content-Type: `multipart/form-data`)
- Create task: `POST /image_to_video` (Content-Type: `application/json`)
- Query status: `GET /image_to_video/{task_id}`
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoints
- Base URL: `https://api.keevx.com/v1`
- Upload image: `POST /figure-resource/upload/file` (Content-Type: `multipart/form-data`)
- Create task: `POST /image_to_video` (Content-Type: `application/json`)
- Query status: `GET /image_to_video/{task_id}`
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoints
- Base URL: `https://api.keevx.com/v1`
- Upload image: `POST /figure-resource/upload/file` (Content-Type: `multipart/form-data`)
- Create task: `POST /image_to_video` (Content-Type: `application/json`)
- Query status: `GET /image_to_video/{task_id}`
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoints
- Base URL: `https://api.keevx.com/v1`
- Upload image: `POST /figure-resource/upload/file` (Content-Type: `multipart/form-data`)
- Create task: `POST /image_to_video` (Content-Type: `application/json`)
- Query status: `GET /image_to_video/{task_id}`
The skill instructs users to upload local image files to a third-party service and then use the returned hosted URLs, but it does not explicitly warn that local files leave the user's environment and may be stored externally. This creates a real privacy and data-handling risk, especially if users provide sensitive or proprietary images assuming only local processing.
This finding duplicates the upload example at line 88 and represents the same real risk: a local image is transmitted to a third-party endpoint for hosting/processing. In context, the transmission is part of the advertised feature, but the danger remains because users may not realize the data leaves local control.
curl --location 'https://api.keevx.com/v1/figure-resource/upload/file' \
--header 'Authorization: Bearer $KEEVX_API_KEY' \
--header 'source: skill' \
--form 'file=@"/path/to/local/image.png"'
This finding duplicates the upload example at line 88 and represents the same real risk: a local image is transmitted to a third-party endpoint for hosting/processing. In context, the transmission is part of the advertised feature, but the danger remains because users may not realize the data leaves local control.
curl --location 'https://api.keevx.com/v1/figure-resource/upload/file' \
--header 'Authorization: Bearer $KEEVX_API_KEY' \
--header 'source: skill' \
--form 'file=@"/path/to/local/image.png"'
The skill requires an API key and authenticated calls to an external service but provides no guidance on secure credential handling or the privacy implications of sending prompts, image URLs, and uploaded media to a third party. While this is common for API-based skills, omission of these warnings can lead to inadvertent key exposure or unsafe use with sensitive data.
No suspicious patterns detected.