Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrowly scoped PoYo video-upscaling helper that clearly discloses its API use and credential requirements.
Install only if you intend to use PoYo's hosted video-upscaler. Keep POYO_API_KEY in a server-side environment or secret manager, review the JSON payload before submission, and avoid sending private video or callback URLs unless that is acceptable for your workflow.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content-Type: application/json
Get API keys from <https://poyo.ai/dashboard/api-key>.
Recommended skill env var:
The skill advertises shell-based execution capability via curl in metadata and explicitly references a submission script, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent environment, that ambiguity can permit broader-than-intended shell access or make policy enforcement inconsistent, increasing the risk of unintended command execution or unsafe handling of secrets like POYO_API_KEY.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer YOUR_API_KEY" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
This shell script performs an HTTP POST to a remote API and transmits the contents of the provided payload file along with an authorization token. There is no confirmation prompt, logging, comment, or docstring in the file warning the user that local data and credentials will be used in a network request.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload_file="$1"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"${payload_file}"
No suspicious patterns detected.