PoYo Grok Imagine API

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:20 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward PoYo video-generation helper that sends user-provided prompts and optional image URLs to PoYo, with no hidden persistence or unrelated behavior found.

Install only if you intend to submit Grok Imagine jobs to PoYo. Keep POYO_API_KEY private, avoid sensitive prompts or private image URLs unless you accept PoYo processing them, and use only trusted HTTPS callback URLs that you control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation encourages use of a user-supplied callback_url but does not warn that task metadata and results will be POSTed to an external endpoint under the caller's control. In an agent context, this can enable unintended exfiltration of generated content, task identifiers, or related metadata to arbitrary third-party infrastructure if the callback target is not validated or constrained.

VirusTotal

66/66 vendors flagged this skill as clean.