Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed face-processing API helper, but users should treat uploaded face images and face-swap outputs as sensitive.
Install only if you are comfortable sending face image URLs and related face-analysis results to AceDataCloud. Use images you are authorized to process, avoid non-consensual likeness changes or deceptive face swaps, restrict the API key to needed endpoints where possible, and do not commit the .env token.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
metadata:
author: acedatacloud
version: "1.0"
compatibility: Requires ACEDATACLOUD_API_TOKEN in .env file (get an API key at https://platform.acedata.cloud/console/applications).
---
# Face Transform
The skill processes face images and biometric-derived data through a third-party API, but the description does not warn users that sensitive personal data leaves the local environment. In a face-processing context, this omission is significant because users may unknowingly submit highly sensitive images without informed consent or privacy review.
The quick-start instructs users to send image URLs and an API token to an external service, which causes user data to be transmitted off-platform. In this skill's context that is expected functionality, but it still creates real privacy and data-governance risk because face images are sensitive and the transmission is to a third-party processor.
curl -X POST https://api.acedata.cloud/face/analyze \
-H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"image_url": "https://cdn.acedata.cloud/lrbtcn.jpg"}'
The quick-start instructs users to send image URLs and an API token to an external service, which causes user data to be transmitted off-platform. In this skill's context that is expected functionality, but it still creates real privacy and data-governance risk because face images are sensitive and the transmission is to a third-party processor.
curl -X POST https://api.acedata.cloud/face/analyze \
-H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"image_url": "https://cdn.acedata.cloud/lrbtcn.jpg"}'
The documentation enables face swapping and face modification workflows without any warning about consent, impersonation, harassment, or deceptive-media misuse. Because these features can be used to manipulate a person's likeness, omission of safety guidance increases the risk of abuse in non-consensual or fraudulent scenarios.
No suspicious patterns detected.