ClawHub
Back to skill

Security audit

Poyo Gpt 5 4

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PoYo chat-completions helper that sends user-prepared chat payloads to the stated PoYo API only when invoked for that purpose.

Install only if you intend to use PoYo for chat completions. Treat POYO_API_KEY as a secret and assume any payload submitted with the script, including prompts and system messages, will be sent to PoYo's API.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
---
name: poyo-gpt-5-4
description: GPT-5.4 chat completions on PoYo / poyo.ai via `https://api.poyo.ai/v1/chat/completions`; use for `gpt-5.4`, OpenAI-compatible chat payloads, coding help, reasoning, system prompts, multi-turn messages, streaming chat, max_tokens, and server-side chat integration.
metadata: {"openclaw":{"homepage":"https://poyo.ai/models/gpt-5-4","requires":{"bins":["curl"],"env":["POYO_API_KEY"]},"primaryEnv":"POYO_API_KEY"}}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 18)May include surrounding context.

Content-Type: application/json

text

Get API keys from <https://poyo.ai/dashboard/api-key>.

Recommended skill env var:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 53)May include surrounding context.

Basic Chat Example

bash
curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/v1/chat/completions" \
  --header "Authorization: Bearer YOUR_API_KEY" \
  --header "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/submit_gpt_5_4_chat.sh (reported line 13)May include surrounding context.

sh
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/v1/chat/completions" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code file performs a network POST request and transmits the contents of a user-supplied JSON payload to an external API, but the script provides no confirmation prompt, logging, comment, or docstring warning that data will leave the local system. For safety-sensitive automation, users should be clearly informed when input data is being sent to a remote service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/v1/chat/completions" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 5)May include surrounding context.

md
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/v1/chat/completions" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 54)May include surrounding context.

md
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/v1/chat/completions" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 78)May include surrounding context.

md
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/v1/chat/completions" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 104)May include surrounding context.

md
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/v1/chat/completions" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/submit_gpt_5_4_chat.sh (reported line 14)May include surrounding context.

sh
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/v1/chat/completions" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The script reads a sensitive credential from the POYO_API_KEY environment variable, but it does not include any comment, log, or documentation in the file explaining that it depends on and uses a secret for authentication. While expected for API submission, the absence of any disclosure reduces transparency about sensitive environment variable usage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.