Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documented wrapper for a third-party AI API, with expected external data sharing but no hidden execution, persistence, or destructive behavior in the artifacts.
Install only if you are comfortable sending selected prompts, files or file URLs, audio, images, document content, search queries, email details, phone numbers, and API-key-linked metadata to SkillBoss and its downstream providers. Avoid regulated or confidential data unless you have authorization, and require explicit user confirmation before sending email or SMS messages.
The skill routes prompts, documents, audio, images, search queries, email content, phone numbers, and OTP-related data to a third-party API and downstream providers, but the description does not warn users that their data leaves the local environment. This creates a real privacy and consent risk because operators may unknowingly transmit sensitive or regulated data to external services.
The base URL declaration identifies a third-party endpoint as the central service for the skill, confirming that use of the skill involves external data transmission. In context, the risk comes from incomplete disclosure rather than covert behavior.
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.
**Base URL:** `https://api.heybossai.com/v1`
## List Models
This finding duplicates the models request and again reflects transmission of credentials and request metadata to a remote API. It is a true issue in the sense of privacy/external-transfer exposure, though not evidence of malicious behavior.
curl -s -X POST https://api.heybossai.com/v1/models \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\"}"
This finding duplicates the models request and again reflects transmission of credentials and request metadata to a remote API. It is a true issue in the sense of privacy/external-transfer exposure, though not evidence of malicious behavior.
curl -s -X POST https://api.heybossai.com/v1/models \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\"}"
Filtering models still requires sending the API key and request parameters to the external service. This is expected behavior, but it remains a real transmission risk that should be disclosed to users.
Filter by type:
curl -s -X POST https://api.heybossai.com/v1/models \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"types\":\"image\"}"
Pilot task discovery sends credentials to the provider and may reveal enabled capability usage. This is a modest but real third-party disclosure issue in the absence of warnings.
List available task types:
curl -s -X POST https://api.heybossai.com/v1/pilot \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"discover\":true}"
Smart mode transmits task type and user inputs to a routing service that may then forward data to one of many downstream providers. The routing feature makes the privacy risk broader because users may not know which provider ultimately receives their data.
Run a task (auto-selects best model):
curl -s -X POST https://api.heybossai.com/v1/pilot \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"type\":\"image\",\"inputs\":{\"prompt\":\"A sunset over mountains\"}}"
Chat requests send message history and optional system prompts to a third-party service and potentially downstream LLM vendors. Conversational history often contains sensitive context, making this a meaningful confidentiality risk if not disclosed.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"bedrock/claude-4-5-sonnet\",\"inputs\":{\"messages\":[{\"role\":\"user\",\"content\":\"Explain quantum computing\"}]}}"
This duplicate image-generation URL finding again indicates remote processing of prompts and credentials. The risk is real but stems from ordinary external API use without sufficient disclosure.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/img\",\"inputs\":{\"prompt\":\"A sunset over mountains\"}}"
This duplicate image-generation URL finding again indicates remote processing of prompts and credentials. The risk is real but stems from ordinary external API use without sufficient disclosure.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/img\",\"inputs\":{\"prompt\":\"A sunset over mountains\"}}"
This example not only requests remote image generation but also follows and downloads a returned URL. That expands exposure because the workflow interacts with another external resource and could retrieve untrusted content without any safety note.
Save to file:
URL=$(curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/img\",\"inputs\":{\"prompt\":\"A sunset over mountains\"}}" \
| grep -o '"image_url":"[^"]*"' | cut -d'"' -f4)
This duplicate video-generation endpoint finding again confirms third-party transmission of prompts and metadata. It is expected functionality but still a true privacy concern in context.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/t2v\",\"inputs\":{\"prompt\":\"A cat playing with yarn\"}}"
This duplicate video-generation endpoint finding again confirms third-party transmission of prompts and metadata. It is expected functionality but still a true privacy concern in context.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/t2v\",\"inputs\":{\"prompt\":\"A cat playing with yarn\"}}"
Image-to-video requests send both prompt text and an image URL to the provider. That can leak private media or internal storage locations if users supply sensitive URLs.
Image-to-video:
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"mm/i2v\",\"inputs\":{\"prompt\":\"Zoom in slowly\",\"image\":\"https://example.com/photo.jpg\"}}"
This duplicate TTS endpoint finding again reflects remote transfer of text content. The issue remains lack of disclosure and guardrails around what text is safe to send.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"minimax/speech-01-turbo\",\"inputs\":{\"text\":\"Hello world\",\"input\":\"Hello world\",\"voice\":\"alloy\"}}"
This duplicate TTS endpoint finding again reflects remote transfer of text content. The issue remains lack of disclosure and guardrails around what text is safe to send.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"minimax/speech-01-turbo\",\"inputs\":{\"text\":\"Hello world\",\"input\":\"Hello world\",\"voice\":\"alloy\"}}"
This duplicate STT endpoint finding again highlights that raw audio is sent off-system for processing. Because spoken audio can contain highly sensitive information, the contextual danger is higher than generic prompt transmission.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"openai/whisper-1\",\"inputs\":{\"audio_data\":\"BASE64_AUDIO\",\"filename\":\"recording.mp3\"}}"
This duplicate STT endpoint finding again highlights that raw audio is sent off-system for processing. Because spoken audio can contain highly sensitive information, the contextual danger is higher than generic prompt transmission.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"openai/whisper-1\",\"inputs\":{\"audio_data\":\"BASE64_AUDIO\",\"filename\":\"recording.mp3\"}}"
This duplicate music-generation endpoint again shows external prompt transmission. The privacy risk is lower than for documents or audio, but still present.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"replicate/elevenlabs/music\",\"inputs\":{\"prompt\":\"upbeat electronic\",\"duration\":30}}"
This duplicate music-generation endpoint again shows external prompt transmission. The privacy risk is lower than for documents or audio, but still present.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"replicate/elevenlabs/music\",\"inputs\":{\"prompt\":\"upbeat electronic\",\"duration\":30}}"
This duplicate background-removal finding again confirms remote processing of user-supplied images or image references. Sensitive photos or private URLs could be exposed to third parties.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"replicate/remove-bg\",\"inputs\":{\"image\":\"https://example.com/photo.jpg\"}}"
This duplicate background-removal finding again confirms remote processing of user-supplied images or image references. Sensitive photos or private URLs could be exposed to third parties.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"replicate/remove-bg\",\"inputs\":{\"image\":\"https://example.com/photo.jpg\"}}"
This duplicate document-processing endpoint again represents significant exfiltration risk because documents are commonly sensitive. The context increases danger due to parsing and structured extraction capabilities applied to arbitrary remote files.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"reducto/parse\",\"inputs\":{\"document_url\":\"https://example.com/file.pdf\"}}"
This duplicate document-processing endpoint again represents significant exfiltration risk because documents are commonly sensitive. The context increases danger due to parsing and structured extraction capabilities applied to arbitrary remote files.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"reducto/parse\",\"inputs\":{\"document_url\":\"https://example.com/file.pdf\"}}"
This duplicate web-search endpoint again demonstrates that user queries are shared externally. Search intent itself can be sensitive in enterprise settings.
curl -s -X POST https://api.heybossai.com/v1/run \
-H "Content-Type: application/json" \
-d "{\"api_key\":\"$SKILLBOSS_API_KEY\",\"model\":\"linkup/search\",\"inputs\":{\"query\":\"latest AI news\",\"depth\":\"standard\",\"outputType\":\"searchResults\"}}"
No suspicious patterns detected.