Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent, but it should be reviewed because it sends face images to a third-party API and its helper code exposes broader inputs and facial-analysis options than the stated single-selfie flow.
Review this skill before installing if you are comfortable sending identifiable selfie images and derived facial attributes to Perfect Corp/YouCam. Use a dedicated YouCam API key, prefer local jpg/jpeg files over public URLs, avoid requesting age or gender fields, and treat the generic helper as broader than the stated single-selfie report unless the publisher narrows it with runtime allowlists and clearer consent text.
Interpret colors and features with `references/guide.md`, and do the golden-ratio bucketing yourself (buckets and golden targets are in that file). ## Output rules * For colors, report colors only; do not infer an undertone that was not returned. * Ratios drift slightly between runs and `faceShape` may not be returned; label ratios as approximate and skip missing values instead of filling them in.
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
print(f"[setup] virtual environment already exists at {_VENV_DIR}")
else:
print(f"[setup] creating virtual environment at {_VENV_DIR} ...")
subprocess.run([sys.executable, "-m", "venv", _VENV_DIR], check=True)
venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")
subprocess.run([venv_python, "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run([venv_python, "-m", "pip", "install", "-r", _REQUIREMENTS], check=True)
activate_hint = (No suspicious patterns detected.