Security audit

Zuimei Zjz Api

Security checks across malware telemetry and agentic risk

Overview

This is a real photo-processing API skill, but it embeds shared API credentials and can send sensitive face or ID photos to a third-party service without clear consent, retention, or cleanup controls.

Review before installing. Use only with photos you are comfortable sending to idphoto.huipai.vip, avoid sensitive identity documents unless you understand the provider's privacy terms, and prefer your own scoped API credentials over the embedded shared test credentials. The publisher should remove shared secrets, add an explicit upload-consent step, narrow broad triggers, and document retention/deletion and result URL access controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: Live API credentials are embedded directly in executable sample code and repeated later in the document, contradicting the stated rule against hardcoding secrets. Hardcoded shared credentials can be abused by anyone who reads the skill, leading to quota theft, unauthorized API use, and potential attribution of misuse to the provider or users.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The prompt contains hard-coded API credentials and executable example code that uses them directly. Anyone with access to the skill can extract and reuse these secrets to call the third-party service outside the intended workflow, causing unauthorized usage, quota theft, billing abuse, and loss of control over the associated account.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The prompt hard-codes a live API key and secret directly in executable sample code, exposing credentials to anyone who can read or reuse the skill. This is dangerous because the secrets can be extracted and abused for unauthorized API usage, billing fraud, or impersonation of the service, and the photo-editing context does not justify embedding reusable secrets in the prompt.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The prompt contains hard-coded API credentials that can be extracted and abused by anyone with access to the skill file. Because the code explicitly signs and sends authenticated requests to a third-party image API, exposed credentials can enable unauthorized API usage, billing abuse, and potentially access to associated account resources.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The prompt contains hardcoded API credentials directly in the skill content, which exposes secrets to anyone who can read or extract the prompt and enables unauthorized use of the external service. In an agent skill, this is especially dangerous because the model is explicitly told to execute code using those credentials, turning the prompt into a credential distribution channel rather than just documentation.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The prompt contains hardcoded API credentials directly in the skill content, which exposes reusable secrets to anyone with access to the file and enables unauthorized use of the third-party service. Because the code instructs direct execution against a live API, the exposure is immediately actionable rather than merely illustrative.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The prompt hard-codes a live API key and secret key directly in the skill and instructs the agent to perform authenticated outbound requests. This exposes credentials to anyone with access to the skill content, enables unauthorized reuse of the external service, and turns the skill into a vehicle for exfiltrating user images to a third-party endpoint without robust control boundaries.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The API processes highly sensitive biometric images and returns hosted result URLs, but the documentation does not disclose retention, access controls, URL lifetime, or privacy implications of uploading face photos to a third-party service. In practice, this can lead integrators to send personal images without informed consent or proper safeguards, increasing privacy, compliance, and unintended data exposure risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README instructs users to configure API credentials and upload photos to a third-party image-processing service, but it does not warn that sensitive biometric images and secrets will be transmitted off-device. In the context of ID-photo generation and face enhancement, this omission matters because users may unknowingly send personally sensitive images and long-lived credentials to an external provider, increasing privacy, compliance, and credential-handling risk.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list includes broad everyday phrases such as '帮我处理照片' and '帮我p图', which can cause this skill to activate unexpectedly in general image-editing conversations. Because activation may lead to local file handling and third-party upload of user photos, overbroad routing increases the chance of unintended data transfer.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The workflow instructs the agent to save user photos locally and send them to a third-party API, but the skill does not present a clear privacy notice or obtain explicit user consent for external transmission of biometric/portrait data. Facial images are sensitive personal data, so silent export to an external service materially increases privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation encourages use of built-in shared test credentials without warning users that the credentials are common, may be rate-limited, may expose activity patterns to the provider, and are unsuitable for sensitive workloads. Shared credentials reduce accountability separation and can cause service abuse or unexpected failures affecting all users.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README instructs users to send local image files to a third-party API using API credentials, but it does not disclose that user photos and related biometric data will be transmitted off-device and processed externally. For an image-processing skill handling portraits and face enhancement, this omission can cause users to unknowingly expose sensitive personal data, creating privacy, consent, and compliance risks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The SDK reads local image files and uploads them to a remote third-party API, but the example methods provide no user-facing disclosure, consent flow, or privacy warning. Because the skill handles sensitive biometric-style images such as ID photos and facial enhancement inputs, silent transmission can expose highly sensitive personal data and create compliance/privacy risks.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: This API is explicitly designed to upload user images, including face photos, to a remote production server, yet the specification provides no privacy notice, retention guidance, or warning that biometric/sensitive personal data leaves the local environment. In an agent skill context, this increases the risk of users or downstream integrators sending highly sensitive images without informed consent or appropriate compliance controls.

Missing User Warnings

Low

Confidence: 72% confidence
Finding: The spec documents API key and signature headers but gives no guidance on secure credential storage, transmission, rotation, or prohibition on exposing secrets in client-side contexts. In an agent integration setting, incomplete auth guidance can lead developers to embed long-lived secrets in prompts, client apps, logs, or other unsafe locations, increasing the chance of credential leakage.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill instructs saving a user's photo locally and sending it to an external API, but it does not disclose that sensitive biometric image data leaves the local environment or explain retention, consent, or privacy implications. Because ID photos are highly sensitive personal data, silent transmission to a third party materially increases privacy, compliance, and trust risks.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The embedded code and surrounding instructions direct network upload of user photos to an external service while omitting any warning that credentials are built into the skill and that data is sent off-platform. This is especially dangerous in context because the content encourages direct execution, making secret exposure and undisclosed third-party processing more likely during normal use.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs saving user-uploaded photos locally without informing the user or documenting retention, access controls, or cleanup. Because the content involves personal photos and likely biometric data, undisclosed local storage increases privacy risk, especially on shared or poorly secured hosts.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill causes the user's uploaded image to be sent to an external API service but does not disclose that third-party transfer or obtain informed user consent. In the context of ID-photo and face-image processing, this is particularly sensitive because it involves personal and potentially biometric information being transmitted off-platform.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger phrases are broad enough to match ordinary user requests about blurry or old photos, causing the skill to activate in situations where users may not expect an external API workflow. In this skill, that broad activation is more dangerous because invocation leads to local file handling and remote transmission of user images.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill instructs the agent to save uploaded photos locally and send them to a remote endpoint without clearly informing the user or obtaining consent. Since the content handles personal photos and likely biometric data, silent local storage and third-party transfer create significant privacy and compliance risks.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs saving a user's ID photo locally without any warning, consent flow, or retention guidance, which is risky because ID photos are highly sensitive biometric and identity-related data. In this context, local storage increases exposure to accidental retention, filesystem leakage, logging, backup capture, or access by other users/processes on the host.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The embedded code uploads the user's ID photo to an external third-party API without any explicit notice, consent, or explanation of where the image is being sent. Because the data is a government-style photo of a person's face, undisclosed external transmission materially increases privacy, compliance, and data-sovereignty risk, especially in a skill whose instructions encourage direct execution.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill instructs saving user-uploaded photos locally without warning the user or defining retention, access controls, or cleanup behavior. Since the content processes sensitive identity photos, silent local storage increases privacy risk, accidental disclosure risk, and the chance of lingering biometric data on disk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: examples/typescript_sdk.ts:93

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: prompts/id_photo.md:144

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: prompts/photo_edit.md:32

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: prompts/photo_enhance.md:33

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: prompts/photo_layout.md:46

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: prompts/segment_background.md:53

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: prompts/segment_portrait.md:22

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:40