Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for makeup recommendations and virtual try-on, with privacy-sensitive but disclosed selfie processing through YouCam.
Install only if you are comfortable sending selected selfies or image URLs to Perfect Corp/YouCam for face analysis and makeup rendering. Prefer setting YOUCAM_API_KEY through an environment or platform secret instead of creating credentials.json, and avoid asking the skill to infer unrelated attributes such as age or gender.
requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:(each `effects` item is one category; see the doc's category schema and pattern catalogs) 4. The generation returns a result image URL in `data.results.url`. ## Output rules * **Return the result image URL exactly as given** (you may make it a hyperlink, but do not modify or shorten it). * Explain the recommendation (why this look suits their face shape / skin tone).
print(f"[setup] virtual environment already exists at {_VENV_DIR}")
else:
print(f"[setup] creating virtual environment at {_VENV_DIR} ...")
subprocess.run([sys.executable, "-m", "venv", _VENV_DIR], check=True)
venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")
subprocess.run([venv_python, "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run([venv_python, "-m", "pip", "install", "-r", _REQUIREMENTS], check=True)
activate_hint = (venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")
subprocess.run([venv_python, "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run([venv_python, "-m", "pip", "install", "-r", _REQUIREMENTS], check=True)
activate_hint = (
rf"{_VENV_DIR}\Scripts\activate" if os.name == "nt" else f"source {_VENV_DIR}/bin/activate"No suspicious patterns detected.