YouCam Hair Diagnostics

• Outcome: Pass
• Latest audit: Nov 2, 2026 · 8:45 AM UTC
• Version: 1.1.2

Overview

The skill provides user-selected hair analysis through YouCam, with expected photo uploads and no supported evidence of malicious behavior.

Use this skill only if you are comfortable sending the selected face and scalp photos to YouCam/Perfect Corp and paying the quoted API credits. Type and frizziness require three angles despite the single-selfie description. Protect your API key, review the provider's retention terms, and use updated dependencies; installed dependency versions and provider retention were not verified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (28)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code is a general-purpose YouCam orchestration module, not a hair-diagnostics-specific implementation. Its feature argument is passed to contract loading, task creation, and polling without a hair-health allowlist; reference inputs explicitly accommodate hair transfer and clothes try-on. No orchestration of the four declared metrics or combined-report construction appears in this chunk. Uploading files, downloading URL inputs, and polling are ordinary supporting details and are not independently treated as mismatches. A separate caller could constrain this helper appropriately, but no such restriction is present in the supplied code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code is a shared API execution utility rather than a hair-diagnostics-specific implementation. Its run and status paths delegate the caller's chosen feature to imported helpers, with no visible enforcement of the description's exclusions. It could support the declared workflow, but the supplied chunk exposes materially broader functionality and does not itself assemble the promised report. Setup, authentication, and billing-related commands are supporting implementation details, not independent reasons for the mismatch. The exact available features and underlying network behavior depend on imported modules not supplied here.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

requirements:
  credentials:
    - name: YOUCAM_API_KEY
      source: env | credentials.json (in the skill root, next to SKILL.md)
  network:
    - yce-api-01.makeupar.com
  apis:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

type/frizziness/length, do NOT require the tilted pose.
- Run `python scripts/youcam_core.py validate-key` (0 credits) to confirm the key. If it is not set,
  tell the user to get one at <https://yce.perfectcorp.com/api-console> and set the
  `YOUCAM_API_KEY` env var, or create `credentials.json` in the skill root (see
  `credentials.example.json` for the format).

## Run (only the chosen metrics)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/constants.py (reported line 23)May include surrounding context.

python

SKILL_SCRIPT_ROOT = os.path.dirname(os.path.abspath(__file__))
API_FALLBACK_DOC = os.path.join(SKILL_SCRIPT_ROOT, "api-fallback.yaml")
CREDENTIALS_FILE = os.path.join(os.path.dirname(SKILL_SCRIPT_ROOT), "credentials.json")

# Install dependencies into a local virtual environment in the skill script folder.
VENV_DIR = os.path.join(SKILL_SCRIPT_ROOT, ".venv")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youcam_api.py (reported line 90)May include surrounding context.

python

def get_key() -> str:
    """Resolve the API key from the YOUCAM_API_KEY env var or credentials.json.

    Exits with code 2 and a structured error if no usable key is configured.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youcam_api.py (reported line 108)May include surrounding context.

python

"No API key configured.",
            hint=f'Set the YOUCAM_API_KEY env var, or create {CREDENTIALS_FILE} with {{"api_key": "..."}}'
            + format_hint,
            details="Neither YOUCAM_API_KEY nor credentials.json was found.",
            code=2,
        )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youcam_core.py (reported line 9)May include surrounding context.

python

everything the skill needs.

Auth:
    Set the YOUCAM_API_KEY environment variable, or create a credentials.json file (in the
    skill's root, next to SKILL.md) containing {"api_key": "..."}. The env var is used first
    if both are present. If neither is set, the command & API call fails.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youcam_tasks.py (reported line 123)May include surrounding context.

python

try-on. Follows the same rules as src_file. Not every feature needs this.
        params: Extra options to send along with the request.
        key: The API key to use. Required; the caller (e.g. youcam_core.py's CLI) is
            expected to resolve it from YOUCAM_API_KEY or credentials.json beforehand.
        version: Which version of the feature to call. Defaults to the standard version.
        interval: How many seconds to wait between checks while the job is processing.
        max_polls: How many times to check on the job before giving up and returning

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youcam_tasks.py (reported line 141)May include surrounding context.

python

contract = contract or load_contract(feature)
    if not key:
        raise ValueError(
            "missing API key. set the YOUCAM_API_KEY env var, or create credentials.json "
            "(see credentials.example.json for the format)"
        )
    body = dict(params or {})

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

Each returns JSON (`data.results.hair_*{mapping, term}`). Interpret with `references/guide.md`
and assemble one report.

## Output rules
* For each selected metric, give the term + a plain-language note; end with an overall summary
  and gentle care directions.
* If a metric is missing in the response, skip it — do not fill it in.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/constants.py (reported line 7)May include surrounding context.

python

skills/<skill-name>/
  ├── SKILL.md
  ├── credentials.example.json   # template for credentials.json
  ├── credentials.json           # CREDENTIALS_FILE (user-provided)
  └── scripts/                   # SKILL_SCRIPT_ROOT (this file's folder)
      ├── constants.py, youcam_api.py, ...

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/constants.py (reported line 8)May include surrounding context.

python

skills/<skill-name>/
  ├── SKILL.md
  ├── credentials.example.json   # template for credentials.json
  ├── credentials.json           # CREDENTIALS_FILE (user-provided)
  └── scripts/                   # SKILL_SCRIPT_ROOT (this file's folder)
      ├── constants.py, youcam_api.py, ...
      ├── api-fallback.yaml      # API_FALLBACK_DOC

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/constants.py (reported line 15)May include surrounding context.

python

├── requirements.txt       # REQUIREMENTS_FILE
      └── .venv/                 # VENV_DIR

Every path the scripts use resolves inside `SKILL_SCRIPT_ROOT`, except credentials.json, which lives
one level up in the skill root so users edit it next to SKILL.md rather than inside the vendored code.
"""

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The manifest promises diagnostics from a single selfie, but type and frizziness require three photos.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The manifest at L04–L05 claims that the listed hair-health metrics can be diagnosed from a single selfie. However, L53–L54 require front-, right-, and left-facing photos for type and frizziness, and the execution commands at L66–L67 pass all three images. This materially changes the advertised input requirements and requires users to provide additional personal imagery.

Content

No source excerpt is available for this finding.

The photo-analysis workflow lacks an explicit warning that users' photos will be sent to a third-party service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The workflow processes identifiable face and scalp photographs through an external provider without explicitly requiring a user-facing disclosure and confirmation of that transfer. Naming YouCam and asking about credit costs provides context, but does not ensure users understand that their photographs leave the local environment.

Content

No source excerpt is available for this finding.

Hair-type and frizziness API configurations require three image angles despite the manifest promising diagnosis from a single selfie.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The manifest promises all four hair-health metrics from one selfie, but both hair-type and frizziness schemas require exactly three source images identified as front, right, and left views (L048–L068 and L088–L108). Neither feature offers a single-image alternative, so the configured API requirements do not support the advertised single-selfie workflow; repeating one image would not supply the documented views.

Content

No source excerpt is available for this finding.

The skill implements template discovery for virtual try-on features outside its hair-diagnostics purpose.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The manifest explicitly excludes hairstyle/color try-on and makeup, but list_templates documents support for look-vto looks and hair-transfer styles (L216–L220). It resolves a caller-selected feature's template endpoint and performs an authenticated request (L233–L247), providing a try-on catalog capability that is not justified by computing hair-health metrics from a selfie.

Content

No source excerpt is available for this finding.

Tainted flow: 'put_req' from requests.post (line 295, network input) → requests.put (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/youcam_api.py (reported line 297)May include surrounding context.

python

info = meta.json()["data"]["files"][0]
    put_req = info["requests"][0]
    with open(file_path, "rb") as fh:
        requests.put(
            put_req["url"],
            headers=put_req.get("headers", {"Content-Type": ct}),
            data=fh,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/youcam_api.py (reported line 313)May include surrounding context.

python

Args:
        contract: The feature's loaded API contract, e.g. from load_contract().
        feature: Which YouCam feature to create a task for, e.g. "skin-analysis".
        body: The request payload, e.g. file_id(s)/url(s) and any feature-specific params.
        key: The API key to authenticate the request with.
        version: Which version of the feature to call. Defaults to the standard version.

The hair-diagnostics CLI exposes unrestricted YouCam feature execution beyond its stated diagnostic scope.

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The run command loads a contract for the caller-supplied feature and forwards that feature, arbitrary API parameters, and reference images to the execution backend without a hair-diagnostics allowlist. This exposes any feature supported by the shared backend, rather than restricting execution to the declared hair-health metrics; the file explicitly illustrates skin analysis (L019-L020) and reference-image support for hair transfer and clothing (L141-L144), which the manifest excludes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/youcam_init.py (reported line 49)May include surrounding context.

python

def _run_setup_step(cmd: list[str]) -> None:
    """Run one setup command, exiting with a structured error if it fails."""
    try:
        subprocess.run(cmd, check=True)
    except subprocess.CalledProcessError as exc:
        exit_with_error(
            "setup_failed",

The task runner supports arbitrary YouCam features, including categories explicitly excluded from hair diagnostics.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The caller-controlled feature is passed to load_contract(), create_task(), and poll() without restriction to hair-health diagnostics. The runner also resolves reference inputs specifically intended for hair transfer or clothes try-on (L118–L120, L152–L154), enabling capabilities the manifest explicitly excludes rather than merely implementing the stated diagnostic workflow.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The open-ended requests requirement permits installations to resolve to different, unreviewed releases without integrity hashes. This is a supply-chain hardening weakness rather than evidence of compromise, but the dependency handles API credentials and selfie transfers.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28
PyYAML>=6.0