face swap

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:59 PM UTC
• Version: 1.2.0

Overview

This face-swap skill appears legitimate, but needs review because it directs network uploads and shell-based media handling without enough input and temp-file safety controls.

Install only if you are comfortable sending selected videos and face images to verging.ai and running local media tools on those inputs. Prefer trusted URLs and local files, avoid sensitive media, pin the installer/source where possible, and use a wrapper or implementation that validates numeric options, avoids shell interpolation, and creates a unique private temp directory per run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:11

Finding

Unpinned Third-Party Installation Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:109

Finding

Unsafe Command Construction and Predictable Shared Temporary Files

Content

View full analysis

30s): ```bash ffmpeg -i input.mp4 -ss -to -c:v libx264 -c:a aac /tmp/verging-faceswap/trimmed.mp4 ``` 5. **Check credits** → GET /api/v1/auth/me (need duration × 1 or ×3 for HD) 6. **Upload video only** → POST /upload-video (Form Data) → PUT to presigned URL 7. **Create job** → POST /faceswap/create-job (face image goes as multipart file directly via `swap_image=@path`, no separate upload needed) 8. **Poll status** → GET /faceswap/jobs?job_ids=X every 5 seconds until COMPLETED 9. **Return/download result** → show result_url, optionally curl download ``` ```markdown ## Critical Notes - **Use `Authorization: ApiKey ` (recommended)** — `Bearer ` also works - **Only the VIDEO needs separate upload** via /upload-video + PUT to presigned URL - **Face image is uploaded directly in create-job** as multipart `swap_image=@path` — no separate upload step - **`/upload-video` uses Form Data (`-F`)** — NOT JSON (`-d`) - **Max video duration: 30 seconds** — trim longer videos first - **Temp directory: `/tmp/verging-faceswap/`** — create with `mkdir -p` - If yt-dlp is unavailable, ask user to download video manually ``` ### Technical Analysis The Skill instructs the Agent to construct shell commands using user-provided video URLs, image URLs, file paths, ...[truncated 2952 chars]

Remediation

View remediation

start`, and cap the resulting duration at 30 seconds. 4. Parse URLs with a URL library and permit only explicitly supported schemes such as HTTPS. Reject local-file schemes and ambiguous or malformed URLs. 5. Validate local paths according to an explicit access policy, canonicalize them, and reject paths outside approved directories when appropriate. 6. Replace the fixed directory with a unique directory created for each invocation using a secure primitive such as `mktemp -d`. 7. Set temporary-directory permissions to `0700`, create files exclusively, reject symbolic links, and avoid following links when opening output files. 8. Use unique filenames for each job and prevent concurrent invocations from sharing state. 9. Delete temporary media in a guaranteed cleanup handler on success, failure, cancellation, and timeout. 10. Run media-processing tools with reduced privileges and resource limits because downloaded media is untrusted input. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly encourages fetching remote videos/images and auto-downloading output files, but does not warn users that the skill will initiate network transfers to third-party sources and write files locally. In a security-sensitive agent context, lack of disclosure can lead to unexpected data egress, retrieval of untrusted content, or overwriting/storage of files without informed user consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 50)May include surrounding context.

bash

# ✅ Recommended (canonical form)
curl -H "Authorization: ApiKey vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me

# ✅ Also works (Bearer with API key is supported)
curl -H "Authorization: Bearer vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me

Static analysis

No suspicious patterns detected.