tencentcloud-faceid-detectlivefaceaccurate

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:22 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform its stated Tencent Cloud face-liveness check, but it handles sensitive face images with under-disclosed remote processing and logs full image URLs.

Review before installing. Use only with images you are allowed to process through Tencent Cloud, prefer tightly scoped Tencent Cloud credentials, avoid long-lived or sensitive signed image URLs, and run it in an environment where stderr logs are not broadly retained or shared.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34
• Finding: Unpinned Third-Party SDK Dependency Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```bash pip install tencentcloud-sdk-python ``` ### Technical Analysis The installation instruction retrieves the latest available version of `tencentcloud-sdk-python` without enforcing a reviewed version or validating an integrity hash. Consequently, the code installed and subsequently imported may differ from the version originally reviewed. This does not establish that the named SDK is malicious. However, it creates supply-chain exposure if the package repository, publisher account, distribution artifact, dependency tree, or package-resolution environment is compromised. Installation from an untrusted or misconfigured Python package index could further increase this risk. The application imports and executes the installed SDK in `scripts/main.py`, including modules responsible for credentials, HTTP communication, and API requests. A compromised dependency would therefore execute in the context of the user running the Skill. ### Attack Path 1. An attacker compromises a future SDK release, one of its transitive dependencies, the publisher account, or the package source used by the victim. 2. A user follows the documented unpinned installation command. 3. Package resolution selects the compromised or unexpectedly changed release. 4. Malicious code executes during package installation or when `scripts/main.py` imports the SDK. 5. The malicious package can access resources available to the current process, potentially including Tencent Cloud credentials in environment variables, local files readable by the user, and network access. ### Impact Assessment Successful exploitation could provide code execution with the privileges of the user installing or running the Skill. The accessible scope may include: - `TENCENTCLOUD_SECRET_ID` and `TENCENTCLOUD_SECRET_KEY` - Files readable or w ...[truncated 383 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the SDK to a reviewed, exact version, for example: ```text tencentcloud-sdk-python==REVIEWED_VERSION ``` 2. Place the dependency in a lock file or requirements file with cryptographic hashes, and install it with hash verification: ```bash pip install --require-hashes -r requirements.txt ``` 3. Review and pin all transitive dependencies where the packaging workflow permits. 4. Explicitly use the trusted package index and prevent fallback to untrusted indexes. 5. Integrate dependency vulnerability and provenance checks into release validation. 6. Run the Skill in an isolated environment with only the required filesystem, network, and environment-variable access. 7. Restrict the Tencent Cloud credentials through IAM to only the facial-liveness API operations required by the Skill. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/main.py:216
• Finding: Sensitive Image URL Is Logged to Standard Error Without Redaction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:216` **Vulnerability Type**: Sensitive information exposure through logging **Risk Level**: Low ### Vulnerable Code Snippet ```python print(f"使用图片URL: {args.url}", file=sys.stderr) ``` ### Technical Analysis The Skill prints the complete user-supplied image URL to standard error. Image URLs may contain sensitive query parameters such as presigned object-storage credentials, temporary access tokens, session identifiers, private object names, or other personal information. Logging the complete URL is not necessary to perform facial-liveness detection. Standard error is frequently captured by shell redirection, CI/CD systems, orchestration platforms, agent execution logs, or centralized logging services. Those systems may retain the URL longer than its intended lifetime or expose it to users who are not authorized to access the underlying facial image. Base64 encoding of local images elsewhere in the script is necessary serialization for the declared Tencent Cloud API and is not itself a covert output channel. The identified exposure is specifically the unnecessary verbatim logging of URL input. ### Attack Path 1. A user supplies a private or presigned facial-image URL through `--url`. 2. The script prints the entire URL, including any query string and fragment, to standard error. 3. The execution environment captures standard error in a terminal transcript, CI log, agent log, or centralized logging system. 4. Another user or service with access to those logs retrieves the URL. 5. If the URL remains valid and includes sufficient authorization, that party can request the facial image or reuse embedded credentials within their permitted scope. ### Impact Assessment Exploitation does not grant additional local operating-system privileges. Its impact is limited to the information and authorization contained in the logged URL, but that scope may include: - Unauthorized access to a facial ...[truncated 444 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the URL logging statement because it is not required for the API call. 2. If diagnostic logging is necessary, record only a non-sensitive indicator such as `Using URL image input`. 3. If identifying the destination is operationally necessary, redact user information, query parameters, and fragments before logging. 4. Never log presigned query parameters, access tokens, session identifiers, or full private object paths. 5. Configure execution and centralized logging systems to minimize retention and restrict access to logs. 6. Document that image URLs should use HTTPS and short-lived, narrowly scoped authorization. 7. Add automated tests confirming that command-line secrets and URL query strings never appear in standard output or standard error. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares use of environment-based secrets (`TENCENTCLOUD_SECRET_ID` and `TENCENTCLOUD_SECRET_KEY`) but does not declare any explicit tool scope, permissions, or allowed-tools boundary. This creates an authorization transparency gap: an agent or reviewer cannot easily tell that the skill needs secret access, increasing the risk of unintended secret exposure or overbroad execution in a larger agent framework.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This skill handles face images and image URLs, which are biometric and highly sensitive personal data, yet it does not warn users that their data will be transmitted to Tencent Cloud for remote processing. Without clear disclosure and consent language, users may unknowingly send sensitive biometric data to a third party, creating privacy, compliance, and trust risks that are especially serious given the data type.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script transmits biometric data (face images) or user-supplied image URLs to Tencent Cloud for processing, but it does not present an explicit privacy notice, consent check, or clear warning at the point of transmission. Because facial images are sensitive personal data, silent upload can violate user expectations, internal policy, or privacy/legal requirements, especially when the skill is invoked by another agent on a user's behalf.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: All user-facing documentation is written in Chinese and the skill does not indicate whether another language is supported or whether Chinese is required for a region-specific reason. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the constraint is clearly justified.

Static analysis

No suspicious patterns detected.