ClawHub
Back to skill

Security audit

Clothes Try-On Studio

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent YouCam clothes try-on helper, with expected API-key use, image upload, and local Python setup, but users should understand their photos and prompts go to external services.

Install only if you are comfortable sending personal photos, garment images, and optional video prompts to YouCam/Perfect Corp, with video prompts potentially processed through Gemini as described by the API schema. Prefer local image uploads over public image URLs, use an environment variable for the API key when possible, and review credit costs before each generation step.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (29)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill is presented as narrowly scoped to clothes try-on, but it instructs use of a generic wrapper (`youcam_core.py run --feature ...`) and dynamic API-doc lookup, which can enable adjacent or unrelated YouCam capabilities if the underlying script supports them. That increases the attack surface and makes it easier for an agent to drift into processing makeup, hair, skin, or other sensitive image-analysis/generation workflows contrary to the declared purpose.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
`run --feature "image-to-video" --src_file <img> --param resolution=720 --param dst_duration=5 --param prompt="turn around / runway walk"`
4. Each generation returns a result image/video URL in `data.results.url`.

## Output rules
* **Return the result image/video URL exactly as given** (hyperlink is OK; do not modify or
  shorten it).
* Video takes longer (the poll timeout is set higher); wait for `success`.
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Credential Access

High
Category
Privilege Escalation
Content
"""Shared constants and path resolution for the youcam_core scripts.

- `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill.
- Everything the engine reads/writes lives here except credentials.json, which stays one level up
(a skill's root next to SKILL.md) instead of following the code.
"""
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
"""Shared constants and path resolution for the youcam_core scripts.

- `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill.
- Everything the engine reads/writes lives here except credentials.json, which stays one level up
(a skill's root next to SKILL.md) instead of following the code.
"""
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
"""Shared constants and path resolution for the youcam_core scripts.

- `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill.
- Everything the engine reads/writes lives here except credentials.json, which stays one level up
(a skill's root next to SKILL.md) instead of following the code.
"""
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
"""Shared constants and path resolution for the youcam_core scripts.

- `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill.
- Everything the engine reads/writes lives here except credentials.json, which stays one level up
(a skill's root next to SKILL.md) instead of following the code.
"""
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
"""Shared constants and path resolution for the youcam_core scripts.

- `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill.
- Everything the engine reads/writes lives here except credentials.json, which stays one level up
(a skill's root next to SKILL.md) instead of following the code.
"""
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
"""Shared constants and path resolution for the youcam_core scripts.

- `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill.
- Everything the engine reads/writes lives here except credentials.json, which stays one level up
(a skill's root next to SKILL.md) instead of following the code.
"""
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
"""Shared constants and path resolution for the youcam_core scripts.

- `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill.
- Everything the engine reads/writes lives here except credentials.json, which stays one level up
(a skill's root next to SKILL.md) instead of following the code.
"""
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
"""Shared constants and path resolution for the youcam_core scripts.

- `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill.
- Everything the engine reads/writes lives here except credentials.json, which stays one level up
(a skill's root next to SKILL.md) instead of following the code.
"""
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file is a shared CLI for all YouCam features and its own docstring explicitly advertises unrelated capabilities such as skin analysis, credits, and arbitrary feature execution. In a skill whose manifest is restricted to clothes try-on, exposing a generic backend broadens the reachable capability surface and can let an agent invoke off-scope APIs, creating policy bypass and unexpected processing of sensitive user images.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The run, status, and cost paths accept arbitrary --feature values and pass them directly into downstream API calls without validating that the feature belongs to the clothes try-on scope. That means anyone using this skill can repurpose it to access other YouCam services, including prohibited image-analysis functions, defeating the manifest's intended restrictions.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The exported run() function accepts an arbitrary feature name and loads/contracts/executes that feature without enforcing the manifest’s clothes-try-on-only restriction. In this skill context, that means a caller could invoke disallowed YouCam capabilities such as beauty, hair, or skin-analysis features, bypassing the intended safety and product boundaries.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The schema repeatedly allows `src_file_url` and `ref_file_url` values that must be publicly accessible, which can push users toward exposing personal photos on public URLs and sending them to a third-party AI service. In a virtual try-on skill handling user selfies and clothing images, this creates meaningful privacy and data-leakage risk if users are not explicitly warned that images may become publicly reachable or accessible by external processors.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill is described as a virtual clothes try-on studio with optional short motion video generation, but this schema explicitly states that video prompts are automatically enhanced using Gemini API. That adds an additional generative-language/LLM processing capability not declared in the manifest and not obviously required for outfit try-on or simple motion rendering.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The prompt field states that input can be in any language and will be automatically enhanced and converted to English using Gemini API, without any indication of user consent. That means user-provided text is implicitly forwarded to another model/service, which is a privacy and transparency problem, especially if prompts contain personal, sensitive, or confidential information.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The documentation for load_contract and feature_cfg uses "skin-analysis" as the exemplar feature, which conflicts with the manifest's explicit prohibition on makeup, hair, or skin analysis use. This is not merely incomplete documentation; it actively points maintainers toward a disallowed intent for the skill.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The feature_cfg docstring explicitly says the feature argument can be "skin-analysis", contradicting the manifest's statement that the skill must not be used for skin analysis. This creates intent-code divergence by documenting a prohibited capability as if it were normal usage.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print(f"[setup] virtual environment already exists at {_VENV_DIR}")
    else:
        print(f"[setup] creating virtual environment at {_VENV_DIR} ...")
        subprocess.run([sys.executable, "-m", "venv", _VENV_DIR], check=True)

    venv_python = _venv_python(_VENV_DIR)
    print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
venv_python = _venv_python(_VENV_DIR)
    print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")
    subprocess.run([venv_python, "-m", "pip", "install", "--upgrade", "pip"], check=True)
    subprocess.run([venv_python, "-m", "pip", "install", "-r", _REQUIREMENTS], check=True)

    activate_hint = (
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
venv_python = _venv_python(_VENV_DIR)
    print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")
    subprocess.run([venv_python, "-m", "pip", "install", "--upgrade", "pip"], check=True)
    subprocess.run([venv_python, "-m", "pip", "install", "-r", _REQUIREMENTS], check=True)

    activate_hint = (
        rf"{_VENV_DIR}\Scripts\activate" if os.name == "nt" else f"source {_VENV_DIR}/bin/activate"
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The upload() docstring says the feature may be things like "skin-analysis" (L055-L057), and similar examples recur in create_task(), poll(), and run(), while run() also documents "hairstyle photo for a hair transfer" as a supported reference input (L306-L308, L341). The manifest explicitly says this skill is for virtual clothes try-on and should not be used for makeup, hair, or skin analysis, so the documentation actively signals uses outside the declared intent.

Session Persistence

Medium
Category
Rogue Agent
Content
Args:
        contract: The feature's loaded API contract, e.g. from load_contract().
        feature: Which YouCam feature to create a task for, e.g. "skin-analysis".
        body: The request payload, e.g. file_id(s)/url(s) and any feature-specific params.
        key: The API key to authenticate the request with.
        version: Which version of the feature to call. Defaults to the standard version.
Confidence
80% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28
PyYAML>=6.0
Confidence
97% confidence
Finding
The dependency is specified with a lower bound only (`requests>=2.28`), which makes builds non-reproducible and can silently pull in different versions over time. That increases supply-chain risk and makes it impossible to determine from this manifest whether a vulnerable or incompatible release may be installed.

Static analysis

No suspicious patterns detected.