Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrow PoYo API helper that clearly discloses its external submission behavior and API-key requirement.
Install only if you intend to use PoYo's music cover API. Keep POYO_API_KEY server-side, review the JSON payload before submission, and do not pass arbitrary local files to the submit script because the selected file contents are sent to PoYo.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content-Type: application/json
Get API keys from <https://poyo.ai/dashboard/api-key>.
Recommended skill env var:
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer YOUR_API_KEY" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
This shell script performs an HTTP POST to an external service and transmits the contents of a user-supplied JSON payload. Within the file there is no confirmation prompt, logging/print statement, or explanatory comment/docstring warning the user that local data will be sent off-host.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
The script requires and uses POYO_API_KEY from the environment to authenticate a network request. Although the variable check is present, the file does not include any user-facing explanation or comment that the skill consumes a credential for remote submission.
No suspicious patterns detected.