TencentCloud YT Segment Portrait

Binary classification-based human portrait segmentation for complete body contour recognition and image matting.

Security Scan

The skill mostly does what it says (calls Tencent Cloud's portrait-segmentation API) but the manifest, instructions, and code contain inconsistencies and an autonomy requirement that warrant caution before installing or providing credentials.

Purpose & Capability

The code and SKILL.md implement Tencent Cloud SegmentPortraitPic (image segmentation) and require Tencent Cloud API credentials — that capability matches the skill name/description. However the registry metadata declares no required environment variables or primary credential while both the instructions and the script require TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY. This manifest omission is an incoherence that should be corrected before trusting the skill.

Instruction Scope

SKILL.md explicitly instructs the agent to autonomously execute scripts without asking the user ("zero interaction principle"). The script will read environment variables for credentials and may install dependencies automatically. The SKILL.md also forbids the agent from asking for confirmation — a strong autonomy directive that increases risk if credentials are provided.

Install Mechanism

There is no install spec in the registry (instruction-only), but the included script auto-installs the Python Tencent Cloud SDK via subprocess calling pip. Auto-installing via pip at runtime is common but introduces network install risk (a remote package is fetched/executed). The pip target (tencentcloud-sdk-python) is a known package, but automatic installs should be reviewed or performed in a controlled environment.

Credentials

The script requires TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY (and optionally TENCENTCLOUD_TOKEN) — these are the appropriate, minimal credentials for calling Tencent Cloud APIs. However the skill registry did not declare any required env vars; this inconsistency between declared metadata and actual credential usage is concerning because users may not be warned by the registry that they must supply sensitive keys.

Persistence & Privilege

The skill is not always-enabled and does not request system-wide privileges. However SKILL.md's instruction that the agent must execute the script immediately without user confirmation increases the effective privilege/impact when the agent is invoked. The skill does not attempt to modify other skills or system-wide configurations.

What to consider before installing

Before installing or enabling this skill: - Do not supply long-lived production credentials without review. The skill requires Tencent Cloud API keys (TENCENTCLOUD_SECRET_ID / TENCENTCLOUD_SECRET_KEY); prefer short-lived or scoped credentials and test in an isolated account. - Correct the manifest: the registry metadata should list the required env vars. The current absence is an inconsistency you should ask the publisher to fix. - Note the SKILL.md demands autonomous execution without user confirmation. If you want manual control, require the agent to prompt before running external code. - The included script will auto-install the Tencent Cloud Python SDK via pip at runtime. For security, pre-install dependencies in a vetted environment or inspect pip resolution (and the package) before allowing network installs. - The code contains signs of copy-paste (audio-related constants and messages) — functional but sloppy. Test the skill in a sandbox to verify behavior and outputs. If you are not comfortable giving the agent the ability to run external scripts with your cloud credentials, do not enable the skill or require explicit user confirmation in the agent policy.

腾讯云人像分割 Skill

功能描述

本 Skill 提供人像分割能力，识别传入图片中人体的完整轮廓，进行抠像：

场景	API	脚本	图片大小限制	返回方式
人像分割	SegmentPortraitPic	main.py	≤5MB	同步

环境配置指引

密钥配置

本 Skill 需要腾讯云 API 密钥才能正常工作。

Step 1: 开通人像分割服务

🔗 腾讯云人像分割控制台

Step 2: 获取 API 密钥

🔗 腾讯云 API 密钥管理

Step 3: 设置环境变量

Linux / macOS：

export TENCENTCLOUD_SECRET_ID="你的SecretId"
export TENCENTCLOUD_SECRET_KEY="你的SecretKey"

如需持久化：

echo 'export TENCENTCLOUD_SECRET_ID="你的SecretId"' >> ~/.zshrc
echo 'export TENCENTCLOUD_SECRET_KEY="你的SecretKey"' >> ~/.zshrc
source ~/.zshrc

Windows (PowerShell)：

$env:TENCENTCLOUD_SECRET_ID = "你的SecretId"
$env:TENCENTCLOUD_SECRET_KEY = "你的SecretKey"

⚠️ 安全提示：切勿将密钥硬编码在代码中。

Agent 执行指令（必读）

⚠️ 本节是 Agent（AI 模型）的核心执行规范。当用户提供图片并请求人像分割时，Agent 必须严格按照以下步骤自主执行，无需询问用户确认。

🔑 通用执行规则

1. 触发条件：用户提供了图片，且用户意图为人像分割。
2. 零交互原则：Agent 应直接执行脚本，不要向用户询问任何确认。
3. 自动选择脚本：根据上方「选择规则」自动选择合适的脚本。
4. ⛔ 禁止使用大模型自身能力替代人像分割（最高优先级规则）：
   • 人像分割脚本调用失败时，Agent 严禁自行猜测或编造识别内容。
   • 如果调用失败，Agent 必须向用户返回清晰的错误说明。

---

📌 脚本： main.py

python3 <SKILL_DIR>/scripts/main.py "<PIC_INPUT>"

输出示例：

{
    "ResultImageUrl": "https://bda-segment-mini-1258344699.cos.ap-guangzhou.myqcloud.com/Image/1251755623/9e73b301-ad1b-4586-837b-b767e73c4bf2?q-sign-algorithm=sha1&q-ak=AKIDEJJ3lFOnfIpAHAqIJ5d3YqthGfpj8eje&q-sign-time=1772790515%3B1772792315&q-key-time=1772790515%3B1772792315&q-header-list=host&q-url-param-list=&q-signature=60646e91cdebc7215cb73e6fff6e6017478857e4",
    "ResultMaskUrl": "https://bda-segment-mini-1258344699.cos.ap-guangzhou.myqcloud.com/Mask/1251755623/9e73b301-ad1b-4586-837b-b767e73c4bf2?q-sign-algorithm=sha1&q-ak=AKIDEJJ3lFOnfIpAHAqIJ5d3YqthGfpj8eje&q-sign-time=1772790515%3B1772792315&q-key-time=1772790515%3B1772792315&q-header-list=host&q-url-param-list=&q-signature=9f13ed4fa0a3d7819ec0a597ab24ef600e9e2721"
}

---

📋 完整调用示例

python3 /path/to/scripts/main.py "https://example.com/human.png"

❌ Agent 须避免的行为

• 只打印脚本路径而不执行
• 向用户询问"是否要执行人像分割"——应直接执行
• 手动安装依赖——脚本内部自动处理
• 忘记读取输出结果并返回给用户
• 人像分割服务调用失败时，自行编造识别内容

API 参考文档

详细的引擎类型、参数说明、错误码等信息请参阅 references/ 目录下的文档：

• 人像分割API（原始文档）

核心脚本

• scripts/main.py — 人像分割脚本

依赖

• Python 3.7+
• tencentcloud-sdk-python（腾讯云 SDK，main.py 使用）

安装依赖（可选 - 脚本会自动安装）：

pip install tencentcloud-sdk-python requests