Security audit
Security checks for vulnerabilities and agentic risk
This is a clearly scoped PoYo video-generation helper that sends prepared video prompts or payloads to PoYo only when requested, with no hidden persistence or unrelated access found.
Install only if you intend to use PoYo for video generation. Treat POYO_API_KEY as a secret, run the submission script only for payloads you have reviewed, and avoid sending confidential prompts, private image URLs, or sensitive callback URLs unless you trust PoYo and the receiving webhook.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content-Type: application/json
Get API keys from <https://poyo.ai/dashboard/api-key>.
Recommended skill env var:
The skill advertises shell-based execution capability via curl but does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and can allow an agent runtime to invoke shell unexpectedly, increasing the chance of unintended command execution or data egress when handling untrusted prompts or payloads.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer YOUR_API_KEY" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
This shell script performs an HTTP POST to an external API and includes both the contents of a user-supplied JSON file and a bearer token from an environment variable. Aside from a usage message and required-variable check, there is no confirmation prompt, log message, or comment disclosing that local data will be sent off-host.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
No suspicious patterns detected.