Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed face-skin analysis integration that sends user-approved face images to RageHealth and does not show hidden persistence, credential theft, or unrelated behavior.
Install only if you are comfortable sending face photos and skin-analysis data to RageHealth. Use dedicated SKIN_PRO_AK/SKIN_PRO_SK credentials, do not share keys in chat, enable face_id only when the user explicitly asks, and prefer pinned dependency versions for reproducible installs.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
try: # pragma: no cover - optional dependency
from dotenv import load_dotenv
load_dotenv(os.path.join(os.path.dirname(__file__), ".env"))
load_dotenv() # also pick up CWD .env
except ImportError:
pass
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
requests>=2.28
pycryptodome>=3.18
python-dotenv>=1.0 # optional: auto-load .env for local dev
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
requests>=2.28
pycryptodome>=3.18
python-dotenv>=1.0 # optional: auto-load .env for local dev
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
requests>=2.28
pycryptodome>=3.18
python-dotenv>=1.0 # optional: auto-load .env for local dev
The skill instructs use of network access, environment-stored credentials, and writing output files, but it does not declare any explicit tool scope or allowed-tools policy. That creates an authorization gap where an agent may invoke broader capabilities than reviewers or platform controls expect, increasing the risk of unintended credential use, external data exfiltration, or file-system side effects when handling sensitive face images.
The file’s operational instructions, trigger phrases, warnings, and examples are all presented exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale limitation is explicitly justified, which is not stated here.
The skill sends highly sensitive face images and derived biometric/health-adjacent skin analysis data to a third-party API, but the code contains no mechanism to ensure explicit user notice or consent before upload. In this skill context, that omission is meaningful because users may not realize their photos leave the local environment and are processed by an external provider.
This markdown file presents all operational instructions and response-field explanations exclusively in Chinese. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in, and the document does not provide an alternative language option or note that it is intentionally region-specific.
Using requests>=2.28 leaves dependency resolution open to any later version, which harms reproducibility and makes it harder to ensure a reviewed, non-vulnerable release is installed. In a skill that sends user facial images to an external API, dependency uncertainty slightly increases supply-chain and runtime risk, though this file alone is not directly exploitable.
requests>=2.28
pycryptodome>=3.18
python-dotenv>=1.0 # optional: auto-load .env for local dev
requests has known advisories, and because the dependency is not pinned, it is impossible to verify from this manifest whether a safe or affected version will be installed. Given this skill likely performs outbound HTTP requests with possibly sensitive face-image data, uncertainty around the HTTP client increases operational risk.
Using pycryptodome>=3.18 allows unreviewed newer versions to be installed and makes builds non-reproducible. Because this package is cryptographic, version ambiguity is more sensitive than for a generic library, even though the requirements entry itself does not prove an active exploit path.
requests>=2.28
pycryptodome>=3.18
python-dotenv>=1.0 # optional: auto-load .env for local dev
pycryptodome has known advisories, and the unpinned spec prevents determining whether deployments use a patched release. Since cryptographic libraries are security-sensitive, unverifiable version selection is a legitimate supply-chain weakness even without proof of immediate compromise.
python-dotenv has known advisories, and because the requirement is not pinned, the manifest cannot show whether an affected version may be installed. The package is marked optional for local development, which reduces risk in production, but it still represents avoidable dependency uncertainty if used in developer environments or accidentally shipped.
No suspicious patterns detected.