ClawHub
Back to skill

Security audit

Skillboss

Security checks across malware telemetry and agentic risk

Overview

This is a documented AI gateway, but it needs review because it can send private content and real-world messages through outside services without enough safety guidance.

Review before installing. Use a dedicated limited SkillBoss API key, avoid confidential documents, recordings, private images, regulated data, or secrets unless external processing is acceptable, and require explicit approval for every email, SMS, OTP, batch, or high-cost action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (31)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill repeatedly instructs agents to send prompts, documents, audio, phone numbers, email content, and other user-supplied data to https://api.heybossai.com and explicitly routes requests across multiple third-party providers, but it does not warn about data disclosure, retention, provider sharing, or privacy implications. This creates a real security and privacy risk because agents or users may unknowingly transmit sensitive content off-platform to multiple external services.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill exposes outbound email and SMS/OTP features that can cause real-world actions, but it does not include warnings about consent, authorization, possible abuse, or messaging costs. Without guardrails, an agent could send messages or verification codes to third parties without clear user approval, creating spam, harassment, privacy, and operational risks.

External Transmission

Medium
Category
Data Exfiltration
Content
## List Models

```bash
curl -s -X POST https://api.heybossai.com/v1/models \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\"}"
```
Confidence
90% confidence
Finding
This endpoint reference reiterates that model discovery requires outbound transmission of the API key to the SkillBoss service. The issue is not the network call itself, but the missing disclosure and lack of safer credential-handling guidance in the skill.

External Transmission

Medium
Category
Data Exfiltration
Content
## Image Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/img\",\"inputs\":{\"prompt\":\"A sunset over mountains\"}}"
```
Confidence
90% confidence
Finding
This endpoint occurrence again demonstrates external transmission for image generation without any privacy warning. The repeated omission across examples suggests a documentation-level security weakness, not an isolated false positive.

External Transmission

Medium
Category
Data Exfiltration
Content
## Video Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/t2v\",\"inputs\":{\"prompt\":\"A cat playing with yarn\"}}"
```
Confidence
90% confidence
Finding
This endpoint reference confirms outbound transmission for video generation. The risk remains the same: sensitive prompts or media can be exposed off-platform with no warning or consent framework in the skill.

External Transmission

Medium
Category
Data Exfiltration
Content
## Text-to-Speech

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"minimax/speech-01-turbo\",\"inputs\":{\"text\":\"Hello world\",\"input\":\"Hello world\",\"voice\":\"alloy\"}}"
```
Confidence
90% confidence
Finding
This endpoint occurrence again reflects external transmission of text for TTS without disclosure. Repetition of the pattern across sensitive modalities reinforces that the issue is a real, broad privacy weakness.

External Transmission

Medium
Category
Data Exfiltration
Content
## Speech-to-Text

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"openai/whisper-1\",\"inputs\":{\"audio_data\":\"BASE64_AUDIO\",\"filename\":\"recording.mp3\"}}"
```
Confidence
93% confidence
Finding
The STT endpoint reference again confirms upload of user audio to external infrastructure. Audio frequently contains highly sensitive content, so absence of clear warnings is a meaningful vulnerability in context.

External Transmission

Medium
Category
Data Exfiltration
Content
## Music Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"replicate/elevenlabs/music\",\"inputs\":{\"prompt\":\"upbeat electronic\",\"duration\":30}}"
```
Confidence
88% confidence
Finding
This music-generation endpoint example is another outward transfer of prompts to third-party systems with no disclosure. While lower impact than email or document parsing, it is still a true privacy/transmission issue.

External Transmission

Medium
Category
Data Exfiltration
Content
## Background Removal

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"replicate/remove-bg\",\"inputs\":{\"image\":\"https://example.com/photo.jpg\"}}"
```
Confidence
90% confidence
Finding
This background-removal endpoint again transmits user-supplied image references externally. Images can contain PII or proprietary information, and the skill does not communicate that risk.

External Transmission

Medium
Category
Data Exfiltration
Content
## Document Processing

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"reducto/parse\",\"inputs\":{\"document_url\":\"https://example.com/file.pdf\"}}"
```
Confidence
95% confidence
Finding
This document-processing endpoint reiterates a high-sensitivity flow where document contents can leave the environment without warning. In context, the lack of disclosure is clearly dangerous because document parsing/extraction often involves sensitive business records.

External Transmission

Medium
Category
Data Exfiltration
Content
## Web Search

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"linkup/search\",\"inputs\":{\"query\":\"latest AI news\",\"depth\":\"standard\",\"outputType\":\"searchResults\"}}"
```
Confidence
88% confidence
Finding
This search endpoint reference shows user queries being sent externally with no notice. Search queries may look innocuous but often reveal internal concerns, investigations, or user identity details.

External Transmission

Medium
Category
Data Exfiltration
Content
## Email

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"email/send\",\"inputs\":{\"to\":\"user@example.com\",\"subject\":\"Hello\",\"html\":\"<p>Hi there</p>\"}}"
```
Confidence
98% confidence
Finding
This email endpoint reference confirms both external transmission and a real-world action capability. In context, that combination is more dangerous than typical inference APIs because misuse can directly contact victims or expose message content to outside processors.

External Transmission

Medium
Category
Data Exfiltration
Content
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`

## List Models
Confidence
86% confidence
Finding
The base-URL declaration and description establish that all operations route through an external service spanning many third-party providers, but there is no accompanying trust-boundary or privacy disclosure. This omission matters because users may incorrectly assume local-only processing when the skill actually brokers data to multiple vendors.

External Transmission

Medium
Category
Data Exfiltration
Content
## List Models

```bash
curl -s -X POST https://api.heybossai.com/v1/models \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\"}"
```
Confidence
90% confidence
Finding
This endpoint reference reiterates that model discovery requires outbound transmission of the API key to the SkillBoss service. The issue is not the network call itself, but the missing disclosure and lack of safer credential-handling guidance in the skill.

External Transmission

Medium
Category
Data Exfiltration
Content
Filter by type:

```bash
curl -s -X POST https://api.heybossai.com/v1/models \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"types\":\"image\"}"
```
Confidence
89% confidence
Finding
The filtered model-discovery example still transmits credentials and request metadata externally without any warning to the user. It contributes to a pattern throughout the skill of normalizing silent off-platform data transfer.

External Transmission

Medium
Category
Data Exfiltration
Content
List available task types:

```bash
curl -s -X POST https://api.heybossai.com/v1/pilot \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"discover\":true}"
```
Confidence
89% confidence
Finding
The smart-mode discovery endpoint sends account-linked requests to an external service and may influence subsequent provider routing. Since routing behavior is opaque from the skill alone, undisclosed external transmission is more sensitive here than a fixed single-provider integration.

External Transmission

Medium
Category
Data Exfiltration
Content
Run a task (auto-selects best model):

```bash
curl -s -X POST https://api.heybossai.com/v1/pilot \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"type\":\"image\",\"inputs\":{\"prompt\":\"A sunset over mountains\"}}"
```
Confidence
95% confidence
Finding
The smart-mode task example sends prompts to an external routing layer that auto-selects providers, increasing uncertainty about where user data is processed. That makes the missing disclosure and consent guidance particularly important.

External Transmission

Medium
Category
Data Exfiltration
Content
## Chat

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"bedrock/claude-4-5-sonnet\",\"inputs\":{\"messages\":[{\"role\":\"user\",\"content\":\"Explain quantum computing\"}]}}"
```
Confidence
94% confidence
Finding
The chat example sends user messages and optional system prompts externally, potentially exposing sensitive conversational data. Because the skill advertises multiple upstream providers, users need clear notice that conversation content may leave the platform.

External Transmission

Medium
Category
Data Exfiltration
Content
## Image Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/img\",\"inputs\":{\"prompt\":\"A sunset over mountains\"}}"
```
Confidence
90% confidence
Finding
This endpoint occurrence again demonstrates external transmission for image generation without any privacy warning. The repeated omission across examples suggests a documentation-level security weakness, not an isolated false positive.

External Transmission

Medium
Category
Data Exfiltration
Content
Save to file:

```bash
URL=$(curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/img\",\"inputs\":{\"prompt\":\"A sunset over mountains\"}}" \
  | grep -o '"image_url":"[^"]*"' | cut -d'"' -f4)
Confidence
91% confidence
Finding
The 'save to file' example fetches a generated image URL returned by the remote service, extending the external interaction beyond initial submission. Users are not warned that generated media and URLs originate from and may be hosted by third-party infrastructure.

External Transmission

Medium
Category
Data Exfiltration
Content
## Video Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/t2v\",\"inputs\":{\"prompt\":\"A cat playing with yarn\"}}"
```
Confidence
90% confidence
Finding
This endpoint reference confirms outbound transmission for video generation. The risk remains the same: sensitive prompts or media can be exposed off-platform with no warning or consent framework in the skill.

External Transmission

Medium
Category
Data Exfiltration
Content
Image-to-video:

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/i2v\",\"inputs\":{\"prompt\":\"Zoom in slowly\",\"image\":\"https://example.com/photo.jpg\"}}"
```
Confidence
95% confidence
Finding
The image-to-video example sends both a prompt and an external image URL, potentially exposing linked content and metadata to remote processors. This increases privacy risk, especially when the referenced image belongs to a third party or contains sensitive information.

External Transmission

Medium
Category
Data Exfiltration
Content
## Text-to-Speech

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"minimax/speech-01-turbo\",\"inputs\":{\"text\":\"Hello world\",\"input\":\"Hello world\",\"voice\":\"alloy\"}}"
```
Confidence
90% confidence
Finding
This endpoint occurrence again reflects external transmission of text for TTS without disclosure. Repetition of the pattern across sensitive modalities reinforces that the issue is a real, broad privacy weakness.

External Transmission

Medium
Category
Data Exfiltration
Content
## Speech-to-Text

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"openai/whisper-1\",\"inputs\":{\"audio_data\":\"BASE64_AUDIO\",\"filename\":\"recording.mp3\"}}"
```
Confidence
93% confidence
Finding
The STT endpoint reference again confirms upload of user audio to external infrastructure. Audio frequently contains highly sensitive content, so absence of clear warnings is a meaningful vulnerability in context.

External Transmission

Medium
Category
Data Exfiltration
Content
## Music Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Content-Type: application/json" \
  -d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"replicate/elevenlabs/music\",\"inputs\":{\"prompt\":\"upbeat electronic\",\"duration\":30}}"
```
Confidence
88% confidence
Finding
This music-generation endpoint example is another outward transfer of prompts to third-party systems with no disclosure. While lower impact than email or document parsing, it is still a true privacy/transmission issue.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.