Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed PoYo API integration helper that sends prepared Claude Messages payloads only when the user chooses to make an API call.
Install this only if you intend to use PoYo's Claude Sonnet 5 API. Treat POYO_API_KEY as a secret, review payload files before submitting them, and avoid sending private prompts, images, or tool inputs unless that is acceptable for your PoYo account and data policy.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content-Type: application/json
Get API keys from <https://poyo.ai/dashboard/api-key>.
Recommended skill env var:
The skill declares a shell-capable dependency (curl) but does not define any explicit tool scope such as allowed tools or permissions. That leaves execution boundaries implicit, increasing the chance that an agent can invoke shell behavior more broadly than intended when handling user-controlled inputs or preparing live API calls.
The invocation criteria are broad enough to match common activities like coding assistance, planning, summarization, and multi-turn chat, which can cause the skill to activate in many contexts beyond narrowly scoped PoYo API integration. Over-broad triggering increases the risk of unnecessary external model routing, data exposure to third-party infrastructure, or use in situations where safer/local handling would be more appropriate.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: YOUR_API_KEY" \
--header "anthropic-version: 2023-06-01" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
The script performs an HTTP POST to an external API and includes both the contents of the provided payload file and an API key in request headers. There is no confirmation prompt, logging/print statement, or explanatory comment/docstring in the file warning the user that local file contents will be sent to a remote service using credentials from the environment.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/messages" \
--header "x-api-key: ${POYO_API_KEY}" \
--header "anthropic-version: 2023-06-01" \
--header "Content-Type: application/json" \