Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward SkillBoss audio API helper, but users should understand that supplied text, URLs, and audio are sent to SkillBoss for processing.
Install only if you are comfortable sending selected audio, media URLs, generated lyrics, text, and transcripts to SkillBoss using your API key. Avoid confidential meetings, private voice recordings, regulated data, or third-party audio unless you have permission and understand SkillBoss handling and retention terms.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
API_BASE = "https://api.skillboss.co/v1"
def pilot(body: dict) -> dict:
r = requests.post(
f"{API_BASE}/pilot",
headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
json=body,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
audio_url = result["data"]["result"]["audio_url"]
### cURL
```bash
# Generate full song
The documentation instructs users to base64-encode and upload local audio files for remote processing, but it does not clearly warn that potentially sensitive voice content and derived transcripts leave the local environment. This creates a privacy and consent risk, especially for meetings, recordings, or other personal audio containing PII or confidential information.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
vocal_url = result["data"]["result"]["download_urls"]["vocals"]
### cURL
```bash
# Extract stems from URL
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
segments = result["data"]["result"]["segments"]
### cURL
```bash
# Diarize from URL
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
clean_url = result["data"]["result"]["audio_url"]
### cURL
```bash
# Denoise from URL
The skill is advertised as an audio-processing tool, but the documented Chain mode introduces broader chat-based summarization and translation behavior not reflected in the manifest. This capability expansion can let the skill process arbitrary text tasks and increases the chance of misuse, over-broad invocation, or unintended data handling beyond the declared scope.
Documenting a general type: "chat" capability inside an audio skill exposes functionality outside the stated purpose, creating a scope mismatch that can bypass user and platform expectations. If invoked, it may send transcript-derived or arbitrary text to a remote chat processor without users realizing the skill is no longer limited to audio transformation.
The file documents a hardcoded external API endpoint used for audio processing, confirming that user-provided content is transmitted to an outside service. In this skill context, external transmission is expected functionality, but it still creates a real privacy and data-governance risk if users are not informed and sensitive audio is sent without consent.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
The reference explicitly instructs sending user audio or third-party media URLs to a remote SkillBoss API, but it does not warn that content leaves the local environment or discuss privacy/consent implications. Because this skill handles potentially sensitive voice and media data, omission of an off-device transmission notice can mislead users and cause unintended disclosure of personal or copyrighted content.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All requests: POST https://api.skillboss.co/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
No suspicious patterns detected.