Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to document a real Phaya media API, but it exposes broad paid, account, upload/download, and cache-control capabilities without enough scoping or privacy guidance.
Review before installing. Use a scoped Phaya API key with a small credit balance, confirm expensive generation jobs before running them, and avoid sending private prompts, regulated data, unpublished media, or third-party video URLs unless you accept Phaya's and its providers' handling of that data. Be especially cautious with account, upload/download, and cache-invalidation endpoints.
**curl:** ```bash curl -s "$PHAYA_BASE/user/credits" \ -H "Authorization: Bearer $PHAYA_API_KEY" \ | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['credits_balance_formatted'])" ```
**curl:**
```bash
JOB=$(curl -s -X POST "$PHAYA_BASE/text-to-image/generate" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt":"A neon-lit Tokyo street at night, cinematic","aspect_ratio":"16:9"}' \echo "Job ID: $JOB"
while true; do
DATA=$(curl -s "$PHAYA_BASE/text-to-image/status/$JOB" \
-H "Authorization: Bearer $PHAYA_API_KEY")
S=$(echo $DATA | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")
echo "Status: $S"**curl:**
```bash
JOB=$(curl -s -X POST "$PHAYA_BASE/sora2-text-to-video/create" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt":"A dragon flying over misty mountains at dawn","aspect_ratio":"landscape","n_frames":"10"}' \## 16. Phaya-GPT Chat **curl (non-streaming):** ```bash curl -s -X POST "$PHAYA_BASE/phaya-gpt/chat/completions" \ -H "Authorization: Bearer $PHAYA_API_KEY" \
**curl:**
```bash
JOB=$(curl -s -X POST "$PHAYA_BASE/text-to-image/generate" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt":"A neon-lit Tokyo street at night, cinematic","aspect_ratio":"16:9"}' \**curl:**
```bash
JOB=$(curl -s -X POST "$PHAYA_BASE/sora2-text-to-video/create" \
-H "Authorization: Bearer $PHAYA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt":"A dragon flying over misty mountains at dawn","aspect_ratio":"landscape","n_frames":"10"}' \## 16. Phaya-GPT Chat **curl (non-streaming):** ```bash curl -s -X POST "$PHAYA_BASE/phaya-gpt/chat/completions" \ -H "Authorization: Bearer $PHAYA_API_KEY" \
No suspicious patterns detected.