Find Skills

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:34 PM UTC
• Version: 1.0.0

Overview

This skill is a broad remote AI/API broker packaged as a skill-finder, with capabilities like email, SMS, document parsing, audio, and media generation that deserve careful review before use.

Install only if you intentionally want a broad SkillBoss remote API integration, not just a skill finder. Treat prompts, files, audio, document URLs, phone numbers, email content, and generated outputs as data sent to a third-party service and possibly downstream providers; avoid confidential or regulated data unless you have reviewed the provider's terms and controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (40)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest advertises a narrowly scoped skill for discovering/installing skills, but the body exposes a general-purpose broker for dozens of unrelated networked capabilities including generation, search, email, SMS, and document handling. This scope mismatch can cause the skill to be auto-invoked in benign 'how do I do X' situations while granting access to powerful external actions the user did not intend, increasing the chance of covert data transfer or unintended side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Including email sending and SMS OTP operations in a skill purportedly meant to find/install skills is unjustified and materially increases abuse potential. If auto-selected, the skill could transmit messages, trigger OTP workflows, or interact with third parties without the user reasonably expecting those outbound actions from this skill context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill helps when users ask broad questions like 'how do I do X,' which is likely to match a wide range of everyday requests. Combined with the hidden breadth of the documented API, this broad trigger raises the likelihood of inappropriate auto-selection and execution in contexts far beyond skill discovery.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation repeatedly instructs sending prompts, files, audio, document URLs, phone numbers, and email content to an external service but does not warn users about the privacy, retention, or third-party processing implications. In a skill ecosystem, omission of these warnings is dangerous because users may assume local processing or may not realize sensitive data is leaving the environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 74% confidence

Finding

The documentation declares a third-party base URL and bearer-token authentication, confirming that the skill depends on external network transmission and secret use. By itself this is common integration behavior, but without accurate scoping and warnings it contributes to hidden data-flow risk.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

This repeated finding reflects an authenticated request to the external API for model listing, which still transmits credentials and usage data externally. The risk is modest but real because the skill's presentation does not make this remote dependency obvious enough for informed use.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash

curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

This repeated finding reflects an authenticated request to the external API for model listing, which still transmits credentials and usage data externally. The risk is modest but real because the skill's presentation does not make this remote dependency obvious enough for informed use.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash

curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

This request filters models by type using the same external authenticated API, again exposing token use and request patterns to a third party. The issue is less the call itself and more that such remote model-broker operations are packaged under an overly broad, misleading skill description.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Filter by type:

bash

curl -s "https://api.heybossai.com/v1/models?types=image" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 79% confidence

Finding

Fetching model docs by ID from the external provider is another outbound authenticated request. While low impact alone, it reinforces that this skill is effectively an API client for a multi-service broker rather than a narrowly scoped skill-finder.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Get full docs for specific models:

bash

curl -s "https://api.heybossai.com/v1/models?ids=mm/img,bedrock/claude-4-5-sonnet" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents broad chat, image, video, audio, search, scraping, and document-processing features that are unrelated to finding or installing skills. This unnecessary expansion increases the attack surface and creates opportunities for unanticipated external sharing of prompts, files, URLs, and derived content under an innocuous skill name.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The chat completion example sends user messages to a third-party service, which may include sensitive text or internal information. In a correctly labeled chat integration this may be acceptable, but within this skill context it creates unexpected external sharing under an unrelated trigger surface.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Chat

bash

curl -s -X POST https://api.heybossai.com/v1/chat/completions \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This call sends user prompt content to an external image-generation service. In isolation that is normal for such a service, but within a skill presented as a skill-finder it is a risky mismatch that can lead to unexpected sharing of user content and unapproved use of an API key.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This call sends user prompt content to an external image-generation service. In isolation that is normal for such a service, but within a skill presented as a skill-finder it is a risky mismatch that can lead to unexpected sharing of user content and unapproved use of an API key.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This workflow posts a generation request, parses a returned URL, and downloads remote content to a local file. That combines outbound transmission with ingestion of third-party content, increasing supply-chain and content-safety risk beyond simple skill discovery behavior.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Save to file:

bash

URL=$(curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This endpoint transmits prompt data to a remote video-generation service, creating an outbound content-sharing path. Because video generation is unrelated to the stated skill purpose, the surrounding context makes the transmission more suspicious and increases the chance of users unknowingly sending sensitive creative or business content off-platform.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This endpoint transmits prompt data to a remote video-generation service, creating an outbound content-sharing path. Because video generation is unrelated to the stated skill purpose, the surrounding context makes the transmission more suspicious and increases the chance of users unknowingly sending sensitive creative or business content off-platform.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This image-to-video example sends both a prompt and an image URL to an external provider, potentially exposing private media references. Such content transformation is outside the declared mission of finding skills and therefore materially raises the risk of unanticipated data disclosure.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Image-to-video:

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This repeated TTS external call demonstrates transmission of user text to a remote service for audio synthesis. The context makes it risky because the user may not expect any text processing or storage by third-party providers from this skill.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This repeated TTS external call demonstrates transmission of user text to a remote service for audio synthesis. The context makes it risky because the user may not expect any text processing or storage by third-party providers from this skill.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This repeated STT call exports audio content externally, which can expose biometric, personal, or confidential information. The hidden capability is particularly dangerous under a misleading skill identity because it weakens user awareness and informed consent.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This repeated STT call exports audio content externally, which can expose biometric, personal, or confidential information. The hidden capability is particularly dangerous under a misleading skill identity because it weakens user awareness and informed consent.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This music-generation request sends prompts externally to a third-party service. Although common for media APIs, it is unrelated to skill discovery and expands both external data flow and attack surface for no justified reason in this skill.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Music Generation

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This repeated background-removal call shares image references with an external service, which can leak private or proprietary media assets. The danger is amplified by the mismatch between declared purpose and actual processing capabilities.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This repeated background-removal call shares image references with an external service, which can leak private or proprietary media assets. The danger is amplified by the mismatch between declared purpose and actual processing capabilities.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This document-processing example sends a document URL to an external parser/extractor, which could expose sensitive files or internal documents to third parties. In a skill ostensibly about discovering/installing skills, this is a serious and unexpected data-exfiltration vector.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Document Processing

bash

curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.