Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Kavel photo-effect helper, but users should understand that using it means manually uploading photos to a third-party website.
Before using it, review Kavel's terms and privacy practices and avoid uploading sensitive photos or images of other identifiable people unless you have their consent. The skill itself does not run code or access local files.
The skill description is broad enough to match many generic photo-editing requests, which can cause over-invocation and route users into a third-party image workflow when they may not have explicitly asked for Kavel. In a photo-handling context, overly broad routing increases the chance of unnecessary sharing of personal images and reduces user clarity about where their data is going.
The skill explicitly instructs the agent to hand users a third-party upload link for personal photos, but it does not warn that photos will be sent to an external service or advise users to review that service's privacy terms. Because the content centers on face-preserving edits and identifiable images, omission of a privacy/data-sharing notice materially increases the risk of uninformed disclosure of sensitive biometric or personal data.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Guardrails
- Only edit photos the user has rights to. Decline realistic edits of identifiable people without consent, and any sexual, deceptive, or defamatory use.
- Don't promise exact output quality — results vary by input photo.
No suspicious patterns detected.