T08 · Insecure Dependencies
Warning
- Location
scripts/ai-face-analysis.py:7- Finding
Unpinned Third-Party Dependencies and Integrity-Unverified Model Download
- Content
View full analysis
- Remediation
View remediation
Security audit
Face Reading Cn
Security checks for vulnerabilities and agentic risk
Overview
This face-reading skill is mostly coherent as entertainment/cultural content, but it asks users to process face photos and infer sensitive traits while relying on under-scoped external execution and weak privacy safeguards.
Install only if you are comfortable treating all outputs as entertainment and cultural reference, not medical, psychological, hiring, dating, financial, or life advice. Do not upload other people's face photos without consent. Review or remove the VITA integration before use, prefer local-only processing, pin dependencies, verify model downloads, and avoid following the included remote upgrade procedure without a full security diff and checksum/signature verification.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
UPGRADE-PLAN-v1.8.0.md:267- Finding
Unverified Remote Skill Installation and Merge Procedure
- Content
View full analysis
- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/face_image_analysis.py:71- Finding
Execution of a Mutable External VITA Script Outside the Audited Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (53)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The documented scope spans facial analysis, moles, luck, marriage, personality, and improvement advice, but the reported implementation is a narrow text rules engine. This creates a trust and safety issue because the skill’s trigger surface invites users into sensitive inferences about appearance, personality, and future outcomes that the implementation cannot responsibly support.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The documented scope spans facial analysis, moles, luck, marriage, personality, and improvement advice, but the reported implementation is a narrow text rules engine. This creates a trust and safety issue because the skill’s trigger surface invites users into sensitive inferences about appearance, personality, and future outcomes that the implementation cannot responsibly support.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
The documented scope spans facial analysis, moles, luck, marriage, personality, and improvement advice, but the reported implementation is a narrow text rules engine. This creates a trust and safety issue because the skill’s trigger surface invites users into sensitive inferences about appearance, personality, and future outcomes that the implementation cannot responsibly support.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The strategy explicitly introduces AI face recognition, user case submissions, and appearance/mole tracking, all of which involve highly sensitive biometric and health-adjacent personal data. Without clear user-facing privacy warnings, consent flows, retention limits, and handling rules, the skill could collect, infer, or expose sensitive traits and identifiable facial data in ways users do not expect, increasing the risk of privacy harm, profiling, and regulatory violations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Community photo annotation and user-case submission introduce third-party image sharing without any explicit consent, ownership, or privacy requirements in the plan. In a face-reading skill, these submissions may include identifiable facial images and sensitive inferences, making the absence of consent and moderation controls particularly dangerous and likely to expose both subjects and uploaders.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This guidance provides physiognomy-based personality, fortune, and life-outcome interpretations as actionable analysis without a clear disclaimer that such claims are non-scientific and may negatively affect decisions, self-image, or emotional wellbeing. Because the content frames subjective face-reading as structured expertise with risk/benefit advice, users may give it undue credibility and act on misleading or harmful inferences about health, wealth, relationships, or character.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file presents all instructions, examples, and guidance exclusively in Chinese, and does not indicate that users may choose another language or that the skill is intended only for a Chinese-language audience. This can violate a language/locale policy when a skill implicitly forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file presents the skill entirely in Chinese and brands it as "face-reading-cn," but it does not state that the locale is optional, user-selectable, or explicitly limited to a China-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section encourages users to infer emotional state and possible medical conditions from facial color and to act on those inferences through self-monitoring and self-management. Although there is a brief medical reminder later, the guide still presents face color as a meaningful diagnostic signal for mood and health without a strong upfront limitation that such cues are unreliable and should not replace clinical assessment, which can lead to false reassurance, delayed care, or inappropriate self-treatment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file is entirely written in Chinese and presents all content in that locale without any indication that the user can opt into another language. This can override user preferences or exclude users who interact in a different language, which is a prompt-quality and user-consent issue even if it is not a classic security exploit. In a user-facing skill, forced locale can cause misinterpretation of health-related cautions and analysis results.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language instructions, examples, and warnings are all presented in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill file is authored exclusively in Chinese and presents all headings, instructions, examples, and usage guidance in that language, with no indication that the user can choose another language. Under the policy for natural-language violations, forcing a specific language without opt-in is a reportable locale-policy issue.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file provides face-reading scripts and ties facial features and complexion to fortune, personality, and possible health conditions such as '脾胃问题' or '肾气不足' without any disclaimer that this is cultural/entertainment content and not medical, psychological, or professional advice. In the context of a skill explicitly combining face reading, AI image recognition, and psychology, users may over-trust the outputs and make real decisions based on pseudoscientific or health-related claims.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly teaches users to infer health status and fortune from facial color and features, and to apply those judgments to themselves and others, without any warning that such claims are unverified and potentially harmful. In a skill framed as AI-assisted face analysis and psychology, this can mislead users into making health, relationship, or life decisions based on pseudoscientific biometric inference.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file’s natural-language instructions, warnings, and exercises are all presented in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 76% confidence
- Finding
The skill advertises shell-style commands and file access workflows but does not declare any explicit tool scope such as allowed-tools or permissions. In agent environments, undocumented shell/file capabilities increase the chance of unintended command execution or broader access than users expect, especially when image URLs and user-provided arguments are passed into scripts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger list includes broad everyday phrases, making accidental activation likely during ordinary conversation. In this skill’s context, unintended activation is more concerning because the outputs involve physiognomy and personality-style judgments, which can prompt unsolicited analysis of users or third parties.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Ambiguous psychology-related triggers overlap with common conversation and may invoke the skill when users are discussing emotions, self-acceptance, or personality in non-entertainment contexts. Because the skill blends pseudoscientific face-reading with psychology language, accidental activation could produce misleading or harmful advice in sensitive contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill encourages photo-based face analysis without a clear privacy and data-handling warning. Face photos are highly sensitive biometric data, and users need to know whether images are stored, shared with third-party services, retained in logs, or used to infer sensitive traits before they upload them.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The conversation instructions invite users to submit photos for analysis but do not warn against analyzing other people’s images without consent. In a face-reading context, this increases the risk of non-consensual profiling, privacy invasion, and potentially discriminatory or reputational harm based on biometric appearance data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill is written as a Chinese-only guide, including all prompts and example interactions, with no indication that users may choose another language or locale. Under the policy scope for natural-language violations, this is a language/locale constraint that is not presented as optional or region-specific.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document goes beyond face-reading or entertainment and explicitly teaches users how to observe and profile other people covertly, including strangers, in order to influence social interactions. That creates a manipulation playbook for inferring personality, status, or vulnerabilities without consent, which is risky because the skill context encourages deception and social engineering rather than transparent analysis.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file presents itself as respectful and entertainment-focused, but it simultaneously instructs users to 'not leave traces,' analyze people naturally without detection, and disguise facial observation. This contradiction is dangerous because it lowers user caution while normalizing deceptive behavior toward non-consenting targets, making misuse in social, workplace, and dating contexts more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The title explicitly brands the skill as 'Face-Reading-CN', and the entire document is written only in Chinese with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language/locale without user opt-in is a natural-language policy violation unless the regional constraint is clearly documented and justified.
- Content
Static analysis
No suspicious patterns detected.