ClawHub
Back to skill

Security audit

Poyo Gpt 4o Image

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward PoYo image-generation API helper that sends user-provided prompts or image URLs to PoYo using an API key.

Install only if you intend to use PoYo's external service. Do not include secrets or private content in prompts, image URLs, or callback URLs unless you are comfortable sending them to PoYo, and prefer setting POYO_API_KEY as an environment variable rather than passing it on the command line.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs the agent to send bearer-authenticated requests to a third-party API using POYO_API_KEY, but it does not warn that prompts, image URLs, and other payload contents will be transmitted off-platform. In a skill context, this can cause unreviewed disclosure of user data or secrets to an external service, especially if users assume the action is local or do not realize credentials will be used.

External Transmission

Medium
Category
Data Exfiltration
Content
---
name: poyo-gpt-4o-image
description: Use PoYo AI GPT-4o Image through the `https://api.poyo.ai/api/generate/submit` endpoint. Use when a user wants to generate or edit media with this model family, prepare PoYo-compatible payloads, submit jobs, or poll task status for `gpt-4o-image`, `gpt-4o-image-edit`.
metadata: {"openclaw": {"homepage":"https://poyo.ai/models/gpt-4o-image-api", "requires": {"bins": ["curl"], "env": ["POYO_API_KEY"]}, "primaryEnv": "POYO_API_KEY"}}
---
Confidence
86% confidence
Finding
https://api.poyo.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick workflow

1. Choose the right model id for the requested output.
2. Build the request body for `POST https://api.poyo.ai/api/generate/submit`.
3. Send Bearer-authenticated JSON with `Authorization: Bearer <POYO_API_KEY>`.
4. Save the returned `task_id`.
5. Poll unified task status or wait for `callback_url` notifications.
Confidence
95% confidence
Finding
https://api.poyo.ai/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.