Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed PoYo API integration that sends user-prepared message payloads to PoYo only for the stated model workflow.
Install this only if you intend to use PoYo's Claude Fable 5 API. Treat POYO_API_KEY as a server-side secret and review each JSON payload before submitting, because messages, system prompts, tool definitions, image content, and other payload data will be sent to PoYo when the script or curl examples are used.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content-Type: application/json
Get API keys from <https://poyo.ai/dashboard/api-key>.
Recommended skill env var:
The skill advertises shell-capable execution via required curl usage and references an executable script, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and can let an agent invoke broader shell functionality than the skill description strictly requires, increasing the chance of unintended command execution or secret exposure.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: YOUR_API_KEY" \
--header "anthropic-version: 2023-06-01" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
This shell script sends the contents of a user-supplied JSON file to a remote service using curl, which is a network operation that may transmit user or system data. The script provides no confirmation prompt, logging, or inline comment/docstring warning the user that the payload file will be sent externally.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
The script requires and accesses the POYO_API_KEY environment variable, which is a sensitive credential. Although the variable is validated for presence, there is no comment or user-facing notice explaining that the script consumes an API key for authentication to an external service.