Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed hair-analysis helper that sends user-selected hair photos to YouCam APIs, with some scope-hardening issues but no evidence of deception or malicious behavior.
Install only if you are comfortable sending hair/selfie photos to YouCam/Perfect Corp and spending API credits after confirmation. Prefer setting YOUCAM_API_KEY as an environment variable instead of storing it in credentials.json, use trusted local image files where possible, and avoid using the generic helper arguments for non-hair or reference-image workflows.
requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:requirements:
credentials:
- name: YOUCAM_API_KEY
source: env | credentials.json (in the skill root, next to SKILL.md)
network:
- yce-api-01.makeupar.com
apis:Each returns JSON (`data.results.hair_*{mapping, term}`). Interpret with `references/guide.md`
and assemble one report.
## Output rules
* For each selected metric, give the term + a plain-language note; end with an overall summary
and gentle care directions.
* If a metric is missing in the response, skip it — do not fill it in.print(f"[setup] virtual environment already exists at {_VENV_DIR}")
else:
print(f"[setup] creating virtual environment at {_VENV_DIR} ...")
subprocess.run([sys.executable, "-m", "venv", _VENV_DIR], check=True)
venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")
subprocess.run([venv_python, "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run([venv_python, "-m", "pip", "install", "-r", _REQUIREMENTS], check=True)
activate_hint = (venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")
subprocess.run([venv_python, "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run([venv_python, "-m", "pip", "install", "-r", _REQUIREMENTS], check=True)
activate_hint = (
rf"{_VENV_DIR}\Scripts\activate" if os.name == "nt" else f"source {_VENV_DIR}/bin/activate"No suspicious patterns detected.