ClawHub
Back to skill

Security audit

Poyo Veo 3 1 Official Api

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a normal PoYo API helper skill, with the main caution that user prompts and media-related URLs are sent to an external service.

Install this only if you are comfortable sending the prompts, media URLs, callback URLs, and related request details you provide to PoYo. Avoid using secrets, internal-only URLs, regulated data, or private media unless you have approved that external data sharing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The examples demonstrate sending prompts, callback URLs, and media URLs to a third-party API but do not clearly warn users that their content leaves the local system and is transmitted to PoYo. In a skill that may be used with sensitive prompts or private media, this omission can cause unintended data disclosure and privacy/compliance issues.

Static analysis

No suspicious patterns detected.