Kling 2.6 Motion Control

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent PoYo API wrapper; the main things to notice are that it uses your PoYo API key and submits media-generation payloads to poyo.ai.

This skill appears safe to install if you intend to let the agent submit Kling 2.6 Motion Control jobs to PoYo. Before use, provide a revocable PoYo API key, review generated payloads and callback URLs, and remember that submissions may consume account quota or credits.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A submitted request may consume PoYo quota or credits and create a media-generation task.

Why it was flagged

The helper directly submits the supplied JSON body to the PoYo generation endpoint. This is the stated purpose of the skill, but it can start a real generation task if run with a payload.

Skill content

curl -sS https://api.poyo.ai/api/generate/submit ... -H "Authorization: Bearer $api_key" ... -d "$body"

Recommendation

Keep submissions user-directed and review the final JSON payload before running the helper or curl command.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent can use the configured PoYo key to submit jobs under the user's account.

Why it was flagged

The script authenticates using a PoYo API key from the environment or command line. This is expected for the PoYo integration, but it delegates account authority to the skill.

Skill content

api_key="${POYO_API_KEY:-${1:-}}" ... -H "Authorization: Bearer $api_key"

Recommendation

Use a revocable or scoped API key if available, prefer the POYO_API_KEY environment variable over passing the key as a command-line argument, and monitor account usage.

Info

#ASI07: Insecure Inter-Agent Communication

What this means

If a callback URL is provided, task status or result notifications may be sent to that endpoint.

Why it was flagged

The documented workflow can involve a provider-to-webhook callback. This is disclosed and optional, but it creates an external data flow that users should configure carefully.

Skill content

`callback_url` (string, optional) — Webhook callback URL for result notifications ... If `callback_url` is present, PoYo sends a POST callback

Recommendation

Use only HTTPS callback URLs you control and omit callback_url when polling status manually is sufficient.