ClawHub
Back to skill

Security audit

iFLYTEK Face Compare

Security checks across malware telemetry and agentic risk

Overview

This skill appears to perform the advertised face comparison, but users should know the selected face images are sent to iFlytek for processing.

Install only if you are comfortable sending the selected face images to iFlytek and you have permission to process those people’s biometric data. Review iFlytek’s privacy and retention terms before using this for authentication, attendance, access control, or other security-sensitive workflows, and protect the required API credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This skill processes face images using a third-party API, which means users' images are transmitted off-device to an external provider, but the description does not clearly warn users of that data transfer. Because face images are biometric data, silent transmission can create significant privacy, compliance, and consent risks even if the implementation is otherwise functional.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The listed use cases center on identity verification and authentication, but the documentation omits any warning that face images constitute sensitive biometric data with elevated privacy and legal implications. In this context, the omission is more dangerous because the skill is explicitly positioned for security-sensitive and identity-related workflows where misuse, overcollection, or improper consent could cause serious harm.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill sends users' face images to a third-party cloud API, but the CLI flow does not clearly warn users that biometric data will leave the local system before transmission occurs. Because face images are sensitive biometric data, silent disclosure to an external service creates privacy, consent, and compliance risk even though the transmission appears intentional for the feature.

External Transmission

Medium
Category
Data Exfiltration
Content
signed_url = self.create_signed_url(self.host_url, "POST")

            print("Calling face compare API...")
            response = requests.post(
                signed_url,
                json=request_body,
                timeout=self.timeout
Confidence
95% confidence
Finding
requests.post( signed_url, json=

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.