AIOZ Stream Toolkit

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 1.0.9

Overview

The skill matches its AIOZ Stream purpose, but its scripts handle secret API keys and user-provided text in ways that deserve review before use.

Install only if you are comfortable giving the skill access to an AIOZ Stream API key that can read account/media data and create or upload resources. Use a narrowly scoped or temporary key if available, inject credentials through a protected environment, avoid running these scripts on shared machines, and be cautious with untrusted video titles, stream names, or search strings until the JSON construction and credential handling are hardened.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_video_file.sh:63
• Finding: API Credentials Exposed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/upload_video_file.sh:63-70, 94-101, 108-112, 120-123`; the same header construction is used throughout the API scripts, including `scripts/analytic_data.sh:47-58, 81-106`, `scripts/create_livestream_key.sh:14-17`, `scripts/get_aggregate_metric.sh:34-57`, `scripts/get_balance.sh:14-16`, `scripts/get_breakdown_metric.sh:35-87`, `scripts/get_media_list.sh:35-37`, `scripts/get_total_media.sh:30-34`, `scripts/get_usage_data.sh:29-31`, `scripts/get_video_list.sh:13-17`, and `scripts/get_video_url_by_name.sh:14-18`. **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash CREATE_RESPONSE=$(curl -s -X POST 'https://api.aiozstream.network/api/media/create' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \ -d "{ \"title\": \"$TITLE\", \"type\": \"video\" }") ``` The upload request repeats the same pattern: ```bash UPLOAD_RESPONSE=$(curl -s -X POST "https://api.aiozstream.network/api/media/$VIDEO_ID/part" \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H "Content-Range: bytes 0-$END_POS/$FILE_SIZE" \ -F "file=@$WORK_FILE" \ -F "index=0" \ -F "hash=$HASH") ``` ### Technical Analysis The scripts correctly obtain credentials from environment variables and send them only to the declared AIOZ Stream HTTPS endpoint. Credential transmission is required for the Skill's legitimate functionality. However, interpolating the secret into a `curl -H` argument places the complete header in the curl process argument vector. Depending on the operating system's process-inspection policy, other local users, privileged monitoring software, process telemetry, or debugging tools may be able to observe the command line while curl is running. The issue is repeated across all API operations. Consequently, frequent analytics request ...[truncated 1462 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Avoid placing sensitive header values directly in process arguments. - Provide headers through a protected temporary curl configuration file or standard input where supported. - If a temporary configuration is necessary: 1. Create it with `mktemp`. 2. Set a restrictive `umask`, such as `umask 077`, before creation. 3. Register a `trap` to remove it on normal exit and signals. 4. Never print its contents or path in verbose logs. - Disable shell tracing around credential handling and ensure callers do not run these scripts under `set -x`. - Prefer short-lived, narrowly scoped API tokens if AIOZ Stream supports them. - Restrict local process inspection through operating-system controls where practical. - Redact authentication headers from process telemetry, monitoring agents, and debugging output. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_video_file.sh:63
• Finding: Video Title Is Interpolated into JSON Without Escaping<![CDATA[ ## Vulnerability Details **File Location**: `scripts/upload_video_file.sh:63-70` **Vulnerability Type**: Authenticated JSON injection and malformed request construction **Risk Level**: Medium ### Vulnerable Code ```bash CREATE_RESPONSE=$(curl -s -X POST 'https://api.aiozstream.network/api/media/create' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \ -d "{ \"title\": \"$TITLE\", \"type\": \"video\" }") ``` ### Technical Analysis `TITLE` is supplied as a positional argument and is inserted directly into a double-quoted JSON document. The script does not perform JSON encoding before interpolation. A title containing a quotation mark, backslash, newline, or JSON syntax can terminate or alter the intended string value. At minimum, legitimate titles containing special characters can produce malformed requests. A crafted title can also introduce additional properties into the authenticated request. Whether duplicate or unexpected properties change server behavior depends on the remote API's JSON parser and schema validation. Shell command substitution is not re-evaluated after parameter expansion, so this is not direct shell command injection. The confirmed flaw is unsafe JSON construction. ### Attack Path 1. An attacker persuades the operator or Agent to upload a video using an attacker-controlled title. 2. The title contains JSON control characters or an injected property sequence. 3. The Agent invokes `upload_video_file.sh` with that title. 4. The script inserts the title into the request body without JSON escaping. 5. The authenticated request is malformed or contains fields beyond the intended `title`. 6. If the server accepts injected or duplicate fields, it may process attacker-selected request semantics under the victim's API credentials. ### Impact Assessment The immediate scope is the authenticated media-creation request. Exploitation can cause denial of ...[truncated 389 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Construct the request with a JSON-aware encoder rather than string interpolation: ```bash CREATE_PAYLOAD=$(jq -n --arg title "$TITLE" '{ title: $title, type: "video" }') CREATE_RESPONSE=$(curl -s -X POST 'https://api.aiozstream.network/api/media/create' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \ --data-binary "$CREATE_PAYLOAD") ``` Additionally: - Validate title length and reject control characters if the API does not support them. - Check curl's exit status and HTTP response status before continuing. - Use `jq -e` when validating response structure. - Add tests covering quotation marks, backslashes, Unicode, and newline characters. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_livestream_key.sh:14
• Finding: Livestream Key Name Is Interpolated into JSON Without Escaping<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create_livestream_key.sh:14-22` **Vulnerability Type**: Authenticated JSON injection and malformed request construction **Risk Level**: Medium ### Vulnerable Code ```bash curl -s -X POST 'https://api.aiozstream.network/api/live_streams' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \ -d '{ "save": true, "type": "video", "name": "'"$KEY_NAME"'" }' ``` ### Technical Analysis The single-quoted JSON string is temporarily closed to interpolate `$KEY_NAME`, but the value is not JSON encoded. A name containing quotation marks or JSON delimiters can break out of the `name` value and insert additional properties. The payload contains security-relevant behavior fields such as `save` and `type`. A crafted value could attempt to append duplicate versions of these properties. The outcome depends on whether the server rejects duplicate keys, honors the first value, or honors the last value. This construction does not cause a second round of shell parsing, so shell metacharacters inside the expanded value do not directly execute commands. The vulnerability is manipulation of the authenticated JSON payload. ### Attack Path 1. An attacker supplies or recommends a crafted livestream key name. 2. The operator or Agent passes the name to `create_livestream_key.sh`. 3. The script embeds it into JSON without escaping. 4. The resulting request contains malformed JSON or attacker-injected properties. 5. The request is authenticated with the victim's API credentials. 6. If accepted by the API, an unintended livestream resource or configuration is created. ### Impact Assessment The flaw affects livestream creation under the authenticated account. It can reliably disrupt creation when malformed syntax is introduced and may modify accepted livestream properties if the API tolerates injected or duplicate fields. The impact remain ...[truncated 183 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Generate the complete payload with `jq`: ```bash REQUEST_BODY=$(jq -n --arg name "$KEY_NAME" '{ save: true, type: "video", name: $name }') curl -s -X POST 'https://api.aiozstream.network/api/live_streams' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \ --data-binary "$REQUEST_BODY" ``` Also enforce the API's documented character set and length restrictions for livestream names. Reject control characters where they have no legitimate use, and verify both curl and HTTP status codes before reporting success. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_total_media.sh:20
• Finding: Media Search Value Is Interpolated into JSON Without Escaping<![CDATA[ ## Vulnerability Details **File Location**: `scripts/get_total_media.sh:20-32` **Vulnerability Type**: Authenticated JSON injection and malformed request construction **Risk Level**: Medium ### Vulnerable Code ```bash if [ -n "$SEARCH" ] && [ -n "$PAGE" ]; then REQUEST_BODY="{\"search\": \"$SEARCH\", \"page\": $PAGE}" elif [ -n "$SEARCH" ]; then REQUEST_BODY="{\"search\": \"$SEARCH\"}" elif [ -n "$PAGE" ]; then REQUEST_BODY="{\"page\": $PAGE}" else REQUEST_BODY='{}' fi curl -s -X POST 'https://api.aiozstream.network/api/media' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \ -d "$REQUEST_BODY" ``` ### Technical Analysis Although `PAGE` is constrained to a non-negative integer, `SEARCH` is copied directly into a JSON string. Quotes, backslashes, newlines, and JSON delimiters are not escaped. A crafted search term can therefore invalidate the body or append properties to the authenticated media-list request. The practical semantic impact depends on which additional filters or fields the endpoint accepts. Legitimate searches containing quotation marks can also fail unexpectedly. ### Attack Path 1. An attacker controls or influences the media search phrase given to the Agent. 2. The phrase contains JSON syntax that closes the intended `search` string. 3. The Agent invokes `get_total_media.sh`. 4. The script creates `REQUEST_BODY` through raw string interpolation. 5. The authenticated request is sent with malformed or injected JSON. 6. The API either rejects the request or applies attacker-selected fields that its schema accepts. ### Impact Assessment The primary impact is integrity and availability of authenticated media queries: searches can fail or return data under unintended filtering or pagination semantics. If the endpoint accepts additional operation-controlling fields, the attacker may influence those fields as well. The reviewed code identifies this endpo ...[truncated 168 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use `jq` to encode the optional values safely: ```bash if [ -n "$SEARCH" ] && [ -n "$PAGE" ]; then REQUEST_BODY=$(jq -n --arg search "$SEARCH" --argjson page "$PAGE" \ '{search: $search, page: $page}') elif [ -n "$SEARCH" ]; then REQUEST_BODY=$(jq -n --arg search "$SEARCH" '{search: $search}') elif [ -n "$PAGE" ]; then REQUEST_BODY=$(jq -n --argjson page "$PAGE" '{page: $page}') else REQUEST_BODY='{}' fi ``` Retain the existing numeric validation for `PAGE`. Add test cases for searches containing quotation marks, backslashes, Unicode characters, and newlines, and validate the HTTP response before returning it as a successful result. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (52)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares shell-capable behavior and instructs execution of local scripts and curl commands, but it does not define an explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and can let an agent invoke broader shell capabilities than are necessary for simple API interactions, increasing the blast radius if the skill is misused or later modified.

External Transmission

Medium

• Category: Data Exfiltration

Content

description: AIOZ Stream secret API key
          required: true
      bins:
        - curl
        - jq
        - md5sum
        - file

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to supply both public and secret API keys for every request but provides no guidance on secure handling. In a skill context, this increases the chance that users paste secrets into chat, logs, or insecure script invocations, leading to credential disclosure and unauthorized access to media and analytics resources.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Passing secret credentials as positional shell arguments can expose them through shell history, process listings, terminal logging, and audit trails. Because this skill is intended to guide API operations, normalizing this pattern makes accidental secret leakage substantially more likely in real deployments.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/live_streams' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This shell script sends sensitive authentication values from environment variables as HTTP headers in a network request. While the usage line shows that keys are required, there is no explicit warning, confirmation, or user-facing disclosure that the script will transmit those credentials to a remote API.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

# Send request to get watch time sum metric
WATCH_TIME_RESPONSE=$(curl -s -X POST "https://api.aiozstream.network/api/analytics/metrics/data/watch_time/sum" \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

# Send request to get watch time sum metric
WATCH_TIME_RESPONSE=$(curl -s -X POST "https://api.aiozstream.network/api/analytics/metrics/data/watch_time/sum" \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code file reads sensitive environment variables and sends them as authentication headers to a remote API. While the usage comment shows how to provide the variables, it does not warn that credentials will be transmitted to an external service, and there is no runtime disclosure, confirmation, or explicit cautionary comment.

External Transmission

Medium

• Category: Data Exfiltration

Content

# {"status":"success","data":{"context":{"metric":"view","time_frame":{"from":"2024-12-31T17:00:00Z","to":"2026-03-24T17:00:00Z"},"breakdown":"device_type","filter":{"media_type":"video"}},"total":2,"data":[{"metric_value":229,"dimension_value":"computer","emitted_at":"0001-01-01T00:00:00Z"},{"metric_value":41,"dimension_value":"phone","emitted_at":"0001-01-01T00:00:00Z"}]}}{"status":"success","data":{"context":{"metric":"view","time_frame":{"from":"2024-12-31T17:00:00Z","to":"2026-03-24T17:00:00Z"},"breakdown":"device_type","filter":{"media_type":"video"}},"total":2,"data":[{"metric_value":229,"dimension_value":"computer","emitted_at":"0001-01-01T00:00:00Z"},{"metric_value":41,"dimension_value":"phone","emitted_at":"0001-01-01T00:00:00Z"}]}}
# Send request to get device type breakdown
DEVICE_TYPE_RESPONSE=$(curl -s -X POST "https://api.aiozstream.network/api/analytics/metrics/bucket/view/device-type" \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# {"status":"success","data":{"context":{"metric":"view","time_frame":{"from":"2024-12-31T17:00:00Z","to":"2026-03-24T17:00:00Z"},"breakdown":"device_type","filter":{"media_type":"video"}},"total":2,"data":[{"metric_value":229,"dimension_value":"computer","emitted_at":"0001-01-01T00:00:00Z"},{"metric_value":41,"dimension_value":"phone","emitted_at":"0001-01-01T00:00:00Z"}]}}{"status":"success","data":{"context":{"metric":"view","time_frame":{"from":"2024-12-31T17:00:00Z","to":"2026-03-24T17:00:00Z"},"breakdown":"device_type","filter":{"media_type":"video"}},"total":2,"data":[{"metric_value":229,"dimension_value":"computer","emitted_at":"0001-01-01T00:00:00Z"},{"metric_value":41,"dimension_value":"phone","emitted_at":"0001-01-01T00:00:00Z"}]}}
# Send request to get device type breakdown
DEVICE_TYPE_RESPONSE=$(curl -s -X POST "https://api.aiozstream.network/api/analytics/metrics/bucket/view/device-type" \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This shell script sends both STREAM_PUBLIC_KEY and STREAM_SECRET_KEY to a remote API via curl headers. Although the usage comment indicates that keys are required, it does not clearly warn the user that credentials will be transmitted over the network, which is a safety-relevant operation under the code-file warning criteria.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This shell script performs an HTTP POST and sends both a public key and secret key as request headers. While the file comments show how to supply the credentials, there is no explicit warning or disclosure that the script will transmit sensitive credentials to a remote API endpoint.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api.aiozstream.network/api/media' \
  -H "stream-public-key: $PUBLIC_KEY" \
  -H "stream-secret-key: $SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.