Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed PoYo Gemini API helper that only sends user-provided payloads to PoYo when the user chooses to run its curl examples or script.
Install this only if you intend to send prompts or payload files to PoYo's API. Keep POYO_API_KEY server-side, review payloads before running the helper script, and avoid using the broad routing language as permission to send unrelated private work to the service.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content-Type: application/json
Get API keys from <https://poyo.ai/dashboard/api-key>.
Recommended skill env var:
The skill declares shell-related execution capability through its metadata and instructions (curl/script usage) but does not define any explicit tool scope such as allowed-tools or permissions. This creates ambiguity about what execution is authorized and can let an agent invoke shell actions more broadly than intended, especially in environments that infer capability from content rather than enforce least privilege.
The 'Use When' section is broad enough to match generic tasks like coding assistance, summarization, and structured responses, which can cause the skill to activate outside its narrow integration purpose. Overbroad routing increases the chance that unrelated or sensitive user data is steered into a third-party API workflow or shell-backed examples when a local or safer skill would have been sufficient.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/chat/completions" \
--header "Authorization: Bearer YOUR_API_KEY" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/chat/completions" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
This shell script sends the contents of a user-supplied JSON file to an external API endpoint and includes an authorization bearer token, but it provides no visible disclosure, confirmation prompt, or explanatory comment about that network transmission. Because this is a code file and the operation transmits user/system data off-host, it meets the missing user warning criteria.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/chat/completions" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/chat/completions" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/chat/completions" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/chat/completions" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/chat/completions" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/chat/completions" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/chat/completions" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/v1/chat/completions" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"