YouCam Skin Analysis Expert

• Outcome: Pass
• Latest audit: Nov 2, 2026 · 8:08 AM UTC
• Version: 1.1.2

Overview

The skill coherently provides YouCam skin analysis, with expected selfie uploads, API charges, and routine dependency risks.

Use this only if you intend to send your selected selfie to YouCam/Perfect Corp and spend API credits. Review the provider's privacy terms and the stated cost, protect your API key, and use maintained dependency versions. Provider data handling and resolved dependency versions remain outside this artifact review. Treat the report as cosmetic guidance rather than a medical diagnosis.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (27)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied code can support skin analysis, but its implemented scope is a generic YouCam API interface rather than the narrowly described skill. The run and templates commands accept caller-selected features, and no skin-only allowlist enforces the explicit exclusions. Results are printed as JSON without enforcing the promised report contents. Dependency setup, API authentication, credit checks, and polling are supporting implementation details, not independent reasons for this finding. Imported modules and any higher-level reporting workflow are not supplied, so their behavior cannot be verified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Uploading a selfie and polling a YouCam task are legitimate supporting implementation details. However, the exposed run() function is not limited to that workflow: its feature argument is unrestricted, and it supports multiple inputs, reference files, and arbitrary feature parameters. This makes the supplied code a broader YouCam execution utility than the narrowly declared skin-analysis skill. The chunk returns task payloads; it does not itself establish the promised 16-score readable report, although reporting could be implemented elsewhere.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

The code exposes capabilities beyond the declared skin-analysis-only scope: list_templates supports non-skin template workflows, and create_task accepts any feature available in the supplied contract with an arbitrary request body. The available feature inventory cannot be confirmed because the contract is not supplied, and no non-skin task execution is shown. Credential loading, billing queries, and selfie upload are supporting implementation details rather than independent mismatches. This chunk also does not establish production of the promised 16-score report, but that could be implemented elsewhere.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

requirements:
  credentials:
    - name: YOUCAM_API_KEY
      source: env | credentials.json (in the skill root, next to SKILL.md)
  network:
    - yce-api-01.makeupar.com
  apis:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

1. A clear, front-facing, single-person selfie with even lighting (jpg/jpeg/png).
2. Run `python scripts/youcam_core.py validate-key` (0 credits) to confirm the key. If it is not set,
   tell the user to get one at <https://yce.perfectcorp.com/api-console> and set the
   `YOUCAM_API_KEY` env var, or create `credentials.json` in the skill root (see
   `credentials.example.json` for the format).
3. Before running, check the cost and tell the user how many credits it will use:
   `python scripts/youcam_core.py cost --feature skin-analysis`

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

It returns scores. Interpret them with `references/interpretation.md` (note the direction
of `ui_score` vs `raw_score`) and assemble the report with `references/output-format.md`.

## Output rules
* Follow the structure in `references/output-format.md` exactly:
  1. **3 lowest-scoring concerns** (worst first) — with scores, star ratings, actionable advice, and their images.
  2. **3 highest-scoring concerns** (best first) — with scores, star ratings, positive note, and their images.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/constants.py (reported line 7)May include surrounding context.

python

skills/<skill-name>/
  ├── SKILL.md
  ├── credentials.example.json   # template for credentials.json
  ├── credentials.json           # CREDENTIALS_FILE (user-provided)
  └── scripts/                   # SKILL_SCRIPT_ROOT (this file's folder)
      ├── constants.py, youcam_api.py, ...

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/constants.py (reported line 8)May include surrounding context.

python

skills/<skill-name>/
  ├── SKILL.md
  ├── credentials.example.json   # template for credentials.json
  ├── credentials.json           # CREDENTIALS_FILE (user-provided)
  └── scripts/                   # SKILL_SCRIPT_ROOT (this file's folder)
      ├── constants.py, youcam_api.py, ...
      ├── api-fallback.yaml      # API_FALLBACK_DOC

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/constants.py (reported line 15)May include surrounding context.

python

├── requirements.txt       # REQUIREMENTS_FILE
      └── .venv/                 # VENV_DIR

Every path the scripts use resolves inside `SKILL_SCRIPT_ROOT`, except credentials.json, which lives
one level up in the skill root so users edit it next to SKILL.md rather than inside the vendored code.
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/constants.py (reported line 23)May include surrounding context.

python

SKILL_SCRIPT_ROOT = os.path.dirname(os.path.abspath(__file__))
API_FALLBACK_DOC = os.path.join(SKILL_SCRIPT_ROOT, "api-fallback.yaml")
CREDENTIALS_FILE = os.path.join(os.path.dirname(SKILL_SCRIPT_ROOT), "credentials.json")

# Install dependencies into a local virtual environment in the skill script folder.
VENV_DIR = os.path.join(SKILL_SCRIPT_ROOT, ".venv")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youcam_api.py (reported line 90)May include surrounding context.

python

def get_key() -> str:
    """Resolve the API key from the YOUCAM_API_KEY env var or credentials.json.

    Exits with code 2 and a structured error if no usable key is configured.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youcam_api.py (reported line 108)May include surrounding context.

python

"No API key configured.",
            hint=f'Set the YOUCAM_API_KEY env var, or create {CREDENTIALS_FILE} with {{"api_key": "..."}}'
            + format_hint,
            details="Neither YOUCAM_API_KEY nor credentials.json was found.",
            code=2,
        )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youcam_core.py (reported line 9)May include surrounding context.

python

everything the skill needs.

Auth:
    Set the YOUCAM_API_KEY environment variable, or create a credentials.json file (in the
    skill's root, next to SKILL.md) containing {"api_key": "..."}. The env var is used first
    if both are present. If neither is set, the command & API call fails.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youcam_tasks.py (reported line 123)May include surrounding context.

python

try-on. Follows the same rules as src_file. Not every feature needs this.
        params: Extra options to send along with the request.
        key: The API key to use. Required; the caller (e.g. youcam_core.py's CLI) is
            expected to resolve it from YOUCAM_API_KEY or credentials.json beforehand.
        version: Which version of the feature to call. Defaults to the standard version.
        interval: How many seconds to wait between checks while the job is processing.
        max_polls: How many times to check on the job before giving up and returning

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youcam_tasks.py (reported line 141)May include surrounding context.

python

contract = contract or load_contract(feature)
    if not key:
        raise ValueError(
            "missing API key. set the YOUCAM_API_KEY env var, or create credentials.json "
            "(see credentials.example.json for the format)"
        )
    body = dict(params or {})

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The workflow uploads the user's selfie to a third-party API without requiring a user-facing privacy disclosure.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The workflow sends an identifiable selfie to an external analysis provider but does not require the agent to disclose that transfer or obtain informed confirmation before uploading. Naming YouCam in skill metadata does not ensure the user sees that information, and the facial image and inferred skin information make undisclosed transmission privacy-sensitive.

Content

No source excerpt is available for this finding.

The API helper exposes template discovery for makeup and hair features that the skin-analysis manifest explicitly excludes.

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The list_templates function explicitly supports look-vto looks and hair-transfer styles (L216–L220), resolves an arbitrary feature's template endpoint, and makes an authenticated request to it (L233–L244). Discovering makeup looks or hair styles is unrelated to scoring skin conditions from a selfie and falls within categories explicitly excluded by the manifest.

Content

No source excerpt is available for this finding.

Tainted flow: 'put_req' from requests.post (line 295, network input) → requests.put (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/youcam_api.py (reported line 297)May include surrounding context.

python

info = meta.json()["data"]["files"][0]
    put_req = info["requests"][0]
    with open(file_path, "rb") as fh:
        requests.put(
            put_req["url"],
            headers=put_req.get("headers", {"Content-Type": ct}),
            data=fh,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/youcam_api.py (reported line 313)May include surrounding context.

python

Args:
        contract: The feature's loaded API contract, e.g. from load_contract().
        feature: Which YouCam feature to create a task for, e.g. "skin-analysis".
        body: The request payload, e.g. file_id(s)/url(s) and any feature-specific params.
        key: The API key to authenticate the request with.
        version: Which version of the feature to call. Defaults to the standard version.

The CLI exposes unrestricted YouCam feature execution beyond the skin-analysis skill's stated scope.

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The run command passes the caller-supplied --feature directly to load_contract and run without restricting it to skin-analysis. This is a general-purpose feature interface: L136 accepts any feature name, and L142 explicitly advertises hair-transfer/cloth-v4 reference images, despite the manifest excluding hair and limiting the skill to skin analysis.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/youcam_init.py (reported line 49)May include surrounding context.

python

def _run_setup_step(cmd: list[str]) -> None:
    """Run one setup command, exiting with a structured error if it fails."""
    try:
        subprocess.run(cmd, check=True)
    except subprocess.CalledProcessError as exc:
        exit_with_error(
            "setup_failed",

The task runner supports arbitrary YouCam features despite the skill's skin-analysis-only scope.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The manifest limits this skill to single-selfie skin analysis and explicitly excludes hair and makeup. However, run() loads a contract using the caller-supplied feature and passes that feature to create_task() without restricting it to skin analysis; it also processes reference inputs expressly intended for hair transfer and clothes try-on (L118–L120, L152–L154). This exposes feature-execution capabilities beyond the skill's stated purpose.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The open-ended requests requirement does not establish a reproducible, reviewed dependency version or artifact. Installation can select different releases over time, creating a conditional supply-chain risk in code that handles API credentials and photo uploads.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28
PyYAML>=6.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

The requests>=2.28 constraint permits versions affected by the cited 2024 advisories, so a satisfying installed version can still be vulnerable. The actual version and exploit prerequisites are not provided, making this a dependency-policy weakness rather than proof of an exploitable installation.

Content

No source excerpt is available for this finding.