Security audit
Security checks for vulnerabilities and agentic risk
The skill appears intended for real YouCam skin analysis, but its bundled runner is broader than the single-selfie use case and handles sensitive face images with limited privacy scoping.
Review before installing. This skill will upload face/selfie data to YouCam/Perfect Corp for analysis using your API key. Use a single local selfie only, avoid URL/reference/video inputs, prefer the YOUCAM_API_KEY environment variable over a credentials.json file, and check the provider’s privacy and retention terms before processing sensitive images.
It returns scores. Interpret them with `references/interpretation.md` (note the direction of `ui_score` vs `raw_score`) and assemble the report with `references/output-format.md`. ## Output rules * Follow the structure in `references/output-format.md` exactly: 1. **3 lowest-scoring concerns** (worst first) — with scores, star ratings, actionable advice, and their images. 2. **3 highest-scoring concerns** (best first) — with scores, star ratings, positive note, and their images.
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
"""Shared constants and path resolution for the youcam_core scripts. - `SKILL_SCRIPT_ROOT` is this `scripts/` folder in a agent skill. - Everything the engine reads/writes lives here except credentials.json, which stays one level up (a skill's root next to SKILL.md) instead of following the code. """
print(f"[setup] virtual environment already exists at {_VENV_DIR}")
else:
print(f"[setup] creating virtual environment at {_VENV_DIR} ...")
subprocess.run([sys.executable, "-m", "venv", _VENV_DIR], check=True)
venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")
subprocess.run([venv_python, "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run([venv_python, "-m", "pip", "install", "-r", _REQUIREMENTS], check=True)
activate_hint = (venv_python = _venv_python(_VENV_DIR)
print(f"[setup] installing dependencies from {_REQUIREMENTS} ...")
subprocess.run([venv_python, "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run([venv_python, "-m", "pip", "install", "-r", _REQUIREMENTS], check=True)
activate_hint = (
rf"{_VENV_DIR}\Scripts\activate" if os.name == "nt" else f"source {_VENV_DIR}/bin/activate"Args:
contract: The feature's loaded API contract, e.g. from load_contract().
feature: Which YouCam feature to create a task for, e.g. "skin-analysis".
body: The request payload, e.g. file_id(s)/url(s) and any feature-specific params.
key: The API key to authenticate the request with.
version: Which version of the feature to call. Defaults to the standard version.No suspicious patterns detected.