Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent hairstyle adviser, but it requires processing portrait photos and generating likeness-based hairstyle previews without clear privacy notice, consent gating, or third-party data-handling disclosure.
Review this skill before installing if you do not want uploaded portraits used for AI hairstyle previews. It should ideally ask before generating or exporting prompts, explain where photos may be sent, and offer a recommendation-only mode.
The README advertises portrait analysis and generated hairstyle preview images but provides no notice about how photos are handled, stored, transmitted, or deleted. Because portrait photos can contain sensitive personal and biometric information, missing privacy disclosures can lead to processing users' images without informed understanding of the associated risks.
The trigger description is broad enough that merely uploading a portrait and asking a general hairstyle question could activate the skill without clear, narrowly scoped consent. In a photo-analysis skill, overbroad activation increases the chance of unintended biometric-style image processing on sensitive portrait data when the user may not expect this specific skill to run.
The instruction '用清晰的中文向用户说明' requires output in Chinese regardless of the user's language preference. This is a natural-language policy issue because it imposes a fixed locale without offering the user a choice or documenting a justified region-specific constraint.
The manifest says the skill analyzes portrait photos and recommends hairstyles, but the workflow mandates creating hairstyle effect images. This scope mismatch can bypass user and platform expectations about what the skill does, especially when portrait images may be sent to external generation tools or transformed into new likeness-based outputs.
The skill goes beyond analysis/recommendation and instructs generating edited or synthetic portrait images, including preserving the user's face while changing hairstyle. That expands the skill into biometric-image transformation and likeness generation, which creates additional privacy, consent, and misuse risks not reflected in the stated skill scope.
The skill requires producing prompts for Kimi, Midjourney, DALL-E, Stable Diffusion, or similar services using the user's portrait, but it does not provide an upfront privacy warning or obtain consent for external processing. Because portrait photos are sensitive personal data, directing users to upload them to third-party platforms without clear disclosure increases privacy and data-handling risk.
The entire reference and its prescribed output format are written as mandatory Chinese-language instructions, including required response sections and phrasing for users. Because no alternative language option or user opt-in is provided, this creates a natural-language locale policy concern under the language/locale rule.
All user-facing descriptive content and usage instructions are written in Chinese, with no indication that other languages are supported or that the locale restriction is intentional. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue.
