ClawHub
Back to skill

Security audit

Poyo Kling O1 Image

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward PoYo image-editing helper that submits user-prepared payloads to PoYo when explicitly requested, with disclosed API-key and data-sharing risks.

Install only if you are comfortable sending selected prompts, image URLs, callback URLs, and generated image metadata to PoYo. Use a scoped PoYo key where possible, avoid confidential inputs unless you trust PoYo and the callback receiver, and run the submit script only on payload JSON files you intentionally prepared.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/submit_kling_o1_image.sh:14
Finding

PoYo API Key Exposed Through Process Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/submit_kling_o1_image.sh, line 14
Vulnerability Type: API credential exposure through command-line arguments
Risk Level: Medium

Vulnerable Code

bash
curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/api/generate/submit" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

Technical Analysis

The shell expands POYO_API_KEY before starting curl, placing the complete bearer token in the process argument vector as part of the authorization header. While the request is running, users, process-monitoring agents, diagnostic tools, or logging systems with permission to inspect process arguments may capture the credential.

Although access to process arguments depends on operating-system permissions and configuration, secrets should not be passed through command-line arguments because argument vectors are not designed as protected secret-storage channels.

Attack Path

  1. A victim sets a valid PoYo API key in POYO_API_KEY.
  2. The victim invokes scripts/submit_kling_o1_image.sh with a payload file.
  3. The shell expands the environment variable into the curl authorization-header argument.
  4. A local user, monitoring utility, audit collector, or process-inspection service with sufficient access reads or records the curl argument vector.
  5. The observer extracts the bearer token.
  6. The exposed token is reused to submit requests to the PoYo API until the credential expires or is revoked.

Impact Assessment

Successful exploitation exposes the privileges granted to the affected PoYo API key. An attacker may be able to submit unauthorized generation requests, consume account credits or quotas, and access any other API capabilities authorized for that credential. The issue does not itself grant operating-system privilege escalation; its scope is limited to the compromised API account an ...[truncated 42 chars]

Remediation
View remediation

Remediation Suggestions

  • Avoid placing the API key directly in curl command-line arguments.
  • Supply the sensitive header through a protected input channel, such as a temporary curl configuration file created with mode 0600 and deleted immediately after use, or another mechanism that does not expose the token in the process argument vector.
  • Ensure temporary secret-bearing files are created securely, cannot be followed through symbolic links, and are removed with an exit trap.
  • Disable shell tracing around secret handling and do not log the generated curl configuration or authorization header.
  • Restrict the API key to the minimum required PoYo permissions and quota where supported.
  • Rotate the credential if process monitoring or command logging may already have captured it.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/submit_kling_o1_image.sh:9
Finding

Arbitrary Local File Can Be Uploaded as an API Payload

Content
View full analysis

Vulnerability Details

File Location: scripts/submit_kling_o1_image.sh, lines 9–16
Vulnerability Type: Unvalidated local file transmission
Risk Level: Low

Vulnerable Code

bash
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/api/generate/submit" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

Technical Analysis

The script accepts an arbitrary path as its only positional argument and instructs curl to read and transmit the complete contents of that path to https://api.poyo.ai/api/generate/submit. It does not verify that the path refers to a regular, non-symbolic-link JSON file, impose a size limit, validate the document against the expected PoYo request schema, or constrain the file to an approved directory.

Quoting "${payload_file}" appropriately prevents shell word splitting and command injection, so this is not a shell-injection vulnerability. The risk instead arises from unrestricted file selection and transmission. If an attacker can influence the argument supplied by a user or agent, the script may be used to disclose a readable local file to the external API endpoint.

Attack Path

  1. An attacker influences instructions, automation input, or the payload path provided to the script.
  2. The attacker supplies the path of a sensitive file readable by the invoking user, including a symbolic link to such a file.
  3. The victim or an automated agent invokes the script with that path.
  4. curl --data @file reads the complete file contents.
  5. The script transmits those contents to the fixed PoYo API endpoint using the victim’s API credential.
  6. The local data leaves the host and may be retained in API request processing or associated logs.

This path requires influence over the script argument and a readable target file. The destination is fixed in the audited script, which limits arbitrary exfiltrat ...[truncated 586 chars]

Remediation
View remediation

Remediation Suggestions

  • Require the supplied path to be an existing regular file and reject symbolic links, devices, directories, and other special files.
  • Resolve the canonical path and, where operationally appropriate, restrict payloads to an approved working directory.
  • Parse the file with a trusted JSON parser before transmission and reject malformed input.
  • Validate the document against an allowlisted schema, including the expected model, input, prompt, image_urls, and supported option fields.
  • Reject unexpected top-level properties and unsupported model identifiers.
  • Enforce a conservative maximum file size before calling curl.
  • Display the canonical source path and fixed external destination and require explicit confirmation when the script is used interactively.
  • Create payloads in a dedicated directory with restrictive permissions rather than accepting unrestricted filesystem paths.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
---
name: poyo-kling-o1-image
description: Kling O1 image editing on PoYo / poyo.ai via `https://api.poyo.ai/api/generate/submit`; use for `kling-o1-image-edit`, reference-image editing, element descriptors, character or object control, 1K, 2K output, aspect ratio, output format, image count, polling, and webhooks.
metadata: {"openclaw":{"homepage":"https://poyo.ai/models/kling-o1-image","requires":{"bins":["curl"],"env":["POYO_API_KEY"]},"primaryEnv":"POYO_API_KEY"}}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 19)May include surrounding context.

Content-Type: application/json

text

Get API keys from <https://poyo.ai/dashboard/api-key>.

Recommended skill env var:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 52)May include surrounding context.

Reference Editing Example

bash
curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/api/generate/submit" \
  --header "Authorization: Bearer YOUR_API_KEY" \
  --header "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/submit_kling_o1_image.sh (reported line 13)May include surrounding context.

sh
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/api/generate/submit" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script performs a network POST to an external API and sends the contents of a user-supplied JSON file along with a bearer token from an environment variable. There is no confirmation prompt, logging, or explanatory comment/docstring warning the user that local file contents and credentials will be used in a remote request.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/api/generate/submit" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 5)May include surrounding context.

md
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/api/generate/submit" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 6)May include surrounding context.

md
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/api/generate/submit" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 53)May include surrounding context.

md
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/api/generate/submit" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 75)May include surrounding context.

md
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/api/generate/submit" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/submit_kling_o1_image.sh (reported line 14)May include surrounding context.

sh
payload_file="$1"

curl --fail-with-body --request POST \
  --url "https://api.poyo.ai/api/generate/submit" \
  --header "Authorization: Bearer ${POYO_API_KEY}" \
  --header "Content-Type: application/json" \
  --data @"${payload_file}"