Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward PoYo add-vocals API helper that discloses its external API use and API-key requirement.
Install only if you intend to send instrumental audio URLs, lyrics or vocal prompts, and optional callback URLs to PoYo. Keep POYO_API_KEY server-side, review payloads before submission, and avoid including private recordings, customer names, or sensitive lyrics unless PoYo handling is acceptable for your use case.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content-Type: application/json
Get API keys from <https://poyo.ai/dashboard/api-key>.
Recommended skill env var:
The skill advertises and instructs use of shell-based execution via curl, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch weakens policy enforcement and can let an agent invoke shell capabilities more broadly than reviewers or runtime controls expect. In this context, the skill also handles a secret API key and external network submission, which makes undeclared shell access more sensitive.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer YOUR_API_KEY" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
This code performs an outbound HTTP POST and uploads the entire contents of the supplied payload file to an external service. The script provides no confirmation prompt, visible disclosure, or inline warning about transmitting user data, so users may not realize local data is being sent off-host.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"