ClawHub
Back to skill

Security audit

Poyo Claude Opus 4 8

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward PoYo Claude API helper that discloses its API key and network use and limits live calls to user-directed use.

Before installing, confirm you are comfortable sending selected request payload content to PoYo when you ask for live calls. Keep POYO_API_KEY server-side, review payloads before submission, and avoid sending private or regulated data unless PoYo is approved for that use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill declares operational shell capability via its required `curl` binary and explicit execution guidance, but the metadata does not expose a corresponding permission model or constrain when shell/network execution is allowed. This creates a trust gap: an agent may invoke shell-based outbound requests without clear sandboxing or user-consent boundaries, increasing the chance of unintended command execution or secret-bearing API calls.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.