Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to document a real Phaya media API, but it exposes broad paid, account, upload/download, and cache-control capabilities without enough scoping or privacy guidance.
Review before installing. Use a scoped Phaya API key with a small credit balance, confirm expensive generation jobs before running them, and avoid sending private prompts, regulated data, unpublished media, or third-party video URLs unless you accept Phaya's and its providers' handling of that data. Be especially cautious with account, upload/download, and cache-invalidation endpoints.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl:
curl -s "$PHAYA_BASE/user/credits" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
| python3 -c "import sys,json; d=json.load(sys.stdin); print(d['credits_balance_formatted'])"
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl:
JOB=$(curl -s -X POST "$PHAYA_BASE/text-to-image/generate" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt":"A neon-lit Tokyo street at night, cinematic","aspect_ratio":"16:9"}' \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
echo "Job ID: $JOB"
while true; do
DATA=$(curl -s "$PHAYA_BASE/text-to-image/status/$JOB" \
-H "Authorization: Bearer $PHAYA_API_KEY")
S=$(echo $DATA | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")
echo "Status: $S"
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl:
JOB=$(curl -s -X POST "$PHAYA_BASE/sora2-text-to-video/create" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt":"A dragon flying over misty mountains at dawn","aspect_ratio":"landscape","n_frames":"10"}' \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl (non-streaming):
curl -s -X POST "$PHAYA_BASE/phaya-gpt/chat/completions" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
The documented capability set materially exceeds the skill’s stated purpose of media generation and chat by including generic media manipulation endpoints and arbitrary third-party video downloading. That broader scope increases abuse potential, data-handling risk, and the chance an agent can be induced to perform actions the user did not reasonably expect from the manifest description.
The documentation explicitly states user content is sent to multiple third parties and stored in Supabase, but it does not provide a clear privacy/data-handling warning, retention disclosure, or user-consent guidance. This creates a real risk of users unintentionally sharing prompts, media, voice, and downloaded content with external processors and storage providers.
A cache invalidation endpoint is an operational control function, not a normal end-user media-generation capability, and its inclusion gives the skill a state-altering administrative action without clear justification. If misused, it can disrupt service behavior, bypass caching protections, or trigger unnecessary backend load and billing-related inconsistencies.
The examples repeatedly instruct users to send API credentials and user prompts/media URLs to a remote SaaS endpoint without any privacy, retention, or third-party sharing warning. In a skill context, this can cause users or downstream agents to exfiltrate sensitive prompts, media, or tokens to an external service without informed consent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl:
JOB=$(curl -s -X POST "$PHAYA_BASE/text-to-image/generate" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt":"A neon-lit Tokyo street at night, cinematic","aspect_ratio":"16:9"}' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl:
JOB=$(curl -s -X POST "$PHAYA_BASE/sora2-text-to-video/create" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt":"A dragon flying over misty mountains at dawn","aspect_ratio":"landscape","n_frames":"10"}' \
The manifest describes the skill as using the Phaya backend to generate images, videos, audio, music, and run LLM chat completions. This examples file documents additional endpoints for Thai subtitle generation and yt-dlp-based video downloading, which are materially different from generation/chat and expand the apparent behavior of the skill beyond what the manifest claims.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl (non-streaming):
curl -s -X POST "$PHAYA_BASE/phaya-gpt/chat/completions" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
The manifest description frames the skill as generating media and running chat completions via the Phaya API. The file additionally documents account-oriented endpoints for fetching the user's profile and credit balance, which are not mentioned in that stated scope. While related to operating the service, they are distinct read-account capabilities beyond the core generation/chat description.
The endpoint is presented as a 'Thai Subtitle Generator' and its behavior is specialized to Thai without stating that this is optional, selectable, or justified as a region-specific tool. Under the language/locale policy, forcing a specific language is a concern unless the locale constraint is clearly documented and justified.
Account and credit-management endpoints are outside the core user-facing purpose described for the skill and create unnecessary privileged surface area. Even if read-only in part, exposing profile, credit history, and related account operations can leak sensitive billing or account state and enable unintended agent behavior.
The manifest mentions media generation and LLM chat completions, but does not mention embeddings or vectorization. The examples file includes an /embedding/create usage pattern, indicating the skill supports an additional AI capability not represented in the declared description.
No suspicious patterns detected.