ClawHub
Back to skill

Security audit

Face Transform

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward AceDataCloud face-processing skill, but it handles sensitive face images and identity-changing edits without enough privacy, consent, or misuse guidance.

Review this carefully before installing. Use it only with images you are authorized to process, get consent from people depicted, avoid deceptive or harmful face edits, and confirm AceDataCloud's privacy, retention, and data handling terms before sending real face images or sensitive datasets.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to send face images to a third-party API but does not clearly warn that highly sensitive biometric-related image data leaves the local environment and is processed externally. Because face photos and derived landmarks can be privacy-sensitive, the omission can lead users to share regulated or personal data without informed consent or appropriate governance review.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill exposes sensitive image-manipulation functions such as face swap, age change, gender change, and beautification without warning about misuse risks like impersonation, deceptive content creation, harassment, or non-consensual edits. In this context, the absence of abuse warnings and usage constraints increases the chance that harmful transformations will be used casually or inappropriately.

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Start

```bash
curl -X POST https://api.acedata.cloud/face/analyze \
  -H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"image_url": "https://example.com/portrait.jpg"}'
Confidence
90% confidence
Finding
This skill explicitly sends user-supplied image references and an authorization token to an external AceDataCloud endpoint, creating a real data egress path. While external API use is expected for this skill, it remains security-relevant because face images are sensitive and the documentation does not provide sufficient disclosure or safeguards around third-party transmission.

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Start

```bash
curl -X POST https://api.acedata.cloud/face/analyze \
  -H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"image_url": "https://example.com/portrait.jpg"}'
Confidence
90% confidence
Finding
This skill explicitly sends user-supplied image references and an authorization token to an external AceDataCloud endpoint, creating a real data egress path. While external API use is expected for this skill, it remains security-relevant because face images are sensitive and the documentation does not provide sufficient disclosure or safeguards around third-party transmission.

Static analysis

No suspicious patterns detected.