ClawHub
Back to skill

Security audit

Poyo Kling 3 0 Turbo

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward PoYo video-generation helper whose API-key and network use are disclosed and scoped to submitting user-requested jobs.

Before installing, confirm you are comfortable using PoYo for the prompts, image URLs, and callback URLs involved. Keep POYO_API_KEY in a server-side environment or secret manager, and only run the submission script for payloads you intended to send.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill declares shell-dependent behavior (`curl` and a submission script) but the static analysis indicates no explicit permissions are declared for that capability. This creates a mismatch between documented execution behavior and the permission model, which can lead to unintended command execution paths being available without clear review or sandbox expectations.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal