Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward PoYo image-generation helper that discloses its external API use and API-key requirement.
Install only if you intend to use PoYo's hosted Nano Banana Pro API. Treat POYO_API_KEY as a secret, review payloads before submission, and avoid including private prompts, private image URLs, callback URLs, or other sensitive data unless you are comfortable sending them to PoYo.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content-Type: application/json
Get API keys from <https://poyo.ai/dashboard/api-key>.
Recommended skill env var:
The skill indicates shell-capable execution via its referenced script and required curl binary, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an avoidable least-privilege gap: an agent may invoke shell functionality more broadly than intended, increasing the chance of unintended command execution or unsafe handling of secrets like POYO_API_KEY.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer YOUR_API_KEY" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
payload_file="$1"
curl -sS https://api.poyo.ai/api/generate/submit \
-H "Authorization: Bearer ${POYO_API_KEY}" \
-H 'Content-Type: application/json' \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
payload_file="$1"
curl -sS https://api.poyo.ai/api/generate/submit \
-H "Authorization: Bearer ${POYO_API_KEY}" \
-H 'Content-Type: application/json' \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
payload_file="$1"
curl -sS https://api.poyo.ai/api/generate/submit \
-H "Authorization: Bearer ${POYO_API_KEY}" \
-H 'Content-Type: application/json' \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
payload_file="$1"
curl -sS https://api.poyo.ai/api/generate/submit \
-H "Authorization: Bearer ${POYO_API_KEY}" \
-H 'Content-Type: application/json' \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
payload_file="$1"
curl -sS https://api.poyo.ai/api/generate/submit \
-H "Authorization: Bearer ${POYO_API_KEY}" \
-H 'Content-Type: application/json' \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
payload_file="$1"
curl -sS https://api.poyo.ai/api/generate/submit \
-H "Authorization: Bearer ${POYO_API_KEY}" \
-H 'Content-Type: application/json' \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
payload_file="$1"
curl -sS https://api.poyo.ai/api/generate/submit \
-H "Authorization: Bearer ${POYO_API_KEY}" \
-H 'Content-Type: application/json' \
--data @"${payload_file}"
The script performs an HTTP request that transmits the full contents of the supplied payload file, potentially including sensitive user data, to an external service. While the command name suggests submission, there is no explicit warning, confirmation, or user-facing disclosure in the script about sending file contents off-host.
No suspicious patterns detected.