Poe Api

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:09 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Poe API client for routing user prompts to external AI models, with ordinary privacy and dependency cautions but no hidden or destructive behavior found.

Before installing, treat any prompt, attached content, code, documents, or search query sent through this skill as data shared with Poe and possibly downstream model providers. Do not send secrets or regulated data unless your environment permits it, set POE_API_KEY only in the environment, and consider pinning dependencies in a lockfile for production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Permits Unreviewed Package Upgrades

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unbounded third-party dependency and non-reproducible installation
Risk Level: Medium

Vulnerable Code

text

openai>=1.0.0

The dependency is installed using the command documented at README.md:278:

bash

pip install -r requirements.txt

Technical Analysis

The version constraint accepts every current or future openai release whose version is at least 1.0.0. The project contains no lockfile, upper version bound, or package integrity hashes. Consequently, installation results can change over time without any modification to this repository.

This does not demonstrate that the current openai package is malicious. However, it creates a supply-chain exposure: a future compromised, malicious, or unexpectedly incompatible release would satisfy the declared constraint and could be installed without project-level review. Python package code executes when imported, and scripts/poe_client.py:27-31 imports the dependency. The dependency also receives the Poe API key during client initialization at scripts/poe_client.py:133-137.

Attack Path

1. An attacker compromises the upstream package publishing process or publishes a malicious future release through a compromised maintainer account.
2. The malicious release has a version greater than or equal to 1.0.0, so it satisfies the project constraint.
3. A user follows the documented installation procedure:

   bash

   pip install -r requirements.txt
   

4. The package manager resolves and installs the compromised version because no exact pin or integrity hash restricts the artifact.
5. The user imports or invokes scripts/poe_client.py, causing dependency-controlled Python code to execute.
6. That code executes with the privileges of the Python process and may access process environment variables, including POE_API_KEY, as well as prompts and responses handled through the API client.

...[truncated 765 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the open-ended constraint with an exact, reviewed version:

   text

   openai==<reviewed-version>
   

2. Generate and commit a dependency lockfile that includes transitive dependencies. Use a tool such as pip-tools, Poetry, or uv according to the project's packaging workflow.

3. Require package integrity hashes during deployment. For pip-based installations, generate hashed requirements and install with:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Update dependencies through a controlled process:

   • Review release notes and provenance.
   • Run automated security and compatibility tests.
   • Scan direct and transitive dependencies.
   • Approve dependency changes before deployment.

5. Install and run the skill under a dedicated, least-privileged account or isolated environment. Expose only the secrets and filesystem paths required for operation.

6. Avoid placing unrelated credentials in the same process environment as POE_API_KEY, reducing the consequences of a compromised dependency.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README encourages use of remote AI and web-search services but does not clearly warn that prompts, context, uploaded data, or search queries may be sent to third-party providers. In an orchestration skill, users may pass source code, credentials, internal documents, or personal data assuming processing is local, which creates a real data leakage and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented usage encourages sending prompts and generating images, video, and audio via external Poe-backed services without any nearby disclosure that user input and generated content will be transmitted to third-party APIs for processing. In an orchestration skill, this omission can cause operators to unknowingly send sensitive code, business data, or personal information to external providers, creating privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly encourages sending prompts to Poe and multiple downstream providers, including web-search and multimodal models, but it does not disclose that prompts, attached content, and potentially sensitive user or workspace data may leave the local environment and be processed by third parties. In an agent setting, this omission can lead users or calling systems to route confidential code, documents, or personal data to external services without informed consent or data-handling review.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · CHANGELOG.md (reported line 102)May include surrounding context.

md

class PoeConfig:
    """Configuration for Poe API client"""
    api_key: str = field(default_factory=lambda: os.getenv("POE_API_KEY", ""))
    base_url: str = "https://api.poe.com/v1"
    
    # Budget control
    max_calls_per_task: int = 10

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/poe_client.py (reported line 92)May include surrounding context.

python

class PoeConfig:
    """Configuration for Poe API client"""
    api_key: str = field(default_factory=lambda: os.getenv("POE_API_KEY", ""))
    base_url: str = "https://api.poe.com/v1"
    
    # Budget control
    max_calls_per_task: int = 10

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The client forwards arbitrary user-supplied prompts to a third-party remote service without any built-in notice, consent mechanism, or data-sensitivity guardrail. In a skill context, users may reasonably provide source code, internal documents, credentials, or other sensitive material, so silent transmission can cause unintended data disclosure to an external provider.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

Lines L710-L715 instruct that programming tasks should use the Claude family, which imposes a vendor/model choice as a natural-language directive rather than offering alternatives based on user preference. This is a mild policy concern because it prescribes a specific selection path without documenting opt-in or a user-choice mechanism.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a lower bound only (openai>=1.0.0), which allows installation of any future release, including breaking or compromised versions. This weakens build reproducibility and increases supply-chain risk because a later upstream release could introduce malicious code or incompatible behavior without changes to this repository.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

openai>=1.0.0

Static analysis

No suspicious patterns detected.