AISkinX护肤AI助手

• Outcome: Review
• Latest audit: May 28, 2026 · 11:36 AM UTC
• Version: 1.0.4

Overview

This skill does not show data theft or destructive behavior, but its privacy and path-safety promises are not reliably enforced in the shipped runtime.

Install only after review or in a constrained environment. Do not rely on its claims of strict path restriction or URL rejection until the broken imports and validation logic are fixed, and treat any skin photos or consultation text as sensitive local data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The code and docstring claim that URLs are explicitly rejected, but `_is_url()` only matches `ftp://`, `www.`, and bare domain-like strings. Common `http://` and `https://` URLs are not detected, so such inputs can bypass the URL rejection logic and be misclassified as file paths or other input types. In a security-sensitive validator, this creates a mismatch between promised and actual behavior and can enable unintended remote resource handling in downstream consumers that trust this validation result.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documents backup/restore and report/history saving features but does not clearly warn that these operations write local files, may overwrite existing data, or may persist sensitive user content. In a privacy-sensitive skincare context, silent persistence can expose personal images, consultation records, and generated reports to other local users or later unintended access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The chat history and progress-tracking features imply local retention of potentially sensitive consultation content, but the documentation does not warn users that personal skincare disclosures may be stored. Because health-adjacent and image-related discussions can contain sensitive personal data, undocumented retention increases privacy and confidentiality risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 版本要求基于Python 3.8+

# 核心依赖
Flask>=2.3.0
Werkzeug>=2.3.0
Jinja2>=3.1.0

• Confidence: 95% confidence
• Finding: Using lower-bound-only dependency specifiers such as 'Flask>=2.3.0' makes builds non-reproducible and can pull in unexpected versions over time, including versions with breaking changes or newly introduced supply-chain risk. In a skill that exposes web functionality, dependency drift can materially affect attack surface and patch posture.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心依赖
Flask>=2.3.0
Werkzeug>=2.3.0
Jinja2>=3.1.0

# 图像处理

• Confidence: 95% confidence
• Finding: Using 'Werkzeug>=2.3.0' leaves dependency resolution open-ended, which harms reproducibility and can introduce vulnerable or incompatible versions unexpectedly. Because Werkzeug is a core web stack component, version drift can directly affect request handling and security behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心依赖
Flask>=2.3.0
Werkzeug>=2.3.0
Jinja2>=3.1.0

# 图像处理
Pillow>=10.0.0

• Confidence: 94% confidence
• Finding: An unpinned Jinja2 dependency allows uncontrolled upgrades and non-deterministic environments. Since templating engines are security-sensitive, especially where user data may be rendered, uncontrolled versions increase risk of inheriting vulnerable releases or behavior changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

Jinja2>=3.1.0

# 图像处理
Pillow>=10.0.0
opencv-python>=4.8.0
numpy>=1.24.0

• Confidence: 93% confidence
• Finding: Pillow is specified with a lower bound only, so the exact installed version depends on resolution time and environment. For image-processing skills handling untrusted images, this is more dangerous because parser libraries often receive security patches for memory corruption and resource exhaustion issues.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 图像处理
Pillow>=10.0.0
opencv-python>=4.8.0
numpy>=1.24.0

# 数据处理

• Confidence: 93% confidence
• Finding: Using 'opencv-python>=4.8.0' creates non-reproducible builds and may allow vulnerable or unstable releases into production. This matters more here because OpenCV processes complex image formats and native code paths that increase the security impact of dependency selection errors.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 图像处理
Pillow>=10.0.0
opencv-python>=4.8.0
numpy>=1.24.0

# 数据处理
pandas>=2.0.0

• Confidence: 92% confidence
• Finding: Lower-bound-only versioning for numpy can lead to inconsistent environments and makes it harder to guarantee that deployments use reviewed artifacts. While numpy itself is often indirect infrastructure, it still affects native-extension attack surface and package resolution across the stack.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.24.0

# 数据处理
pandas>=2.0.0
scikit-learn>=1.3.0
scipy>=1.11.0

• Confidence: 91% confidence
• Finding: Using 'pandas>=2.0.0' instead of an exact version reduces reproducibility and may introduce unsafe or untested versions. The security impact is somewhat lower than web/image parsers, but still relevant for data ingestion workflows and supply-chain hygiene.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 数据处理
pandas>=2.0.0
scikit-learn>=1.3.0
scipy>=1.11.0

# AI/机器学习

• Confidence: 92% confidence
• Finding: An unpinned scikit-learn dependency means builds may unexpectedly consume versions with security or serialization-related issues. In ML-oriented code, this can matter because model loading and preprocessing pipelines often touch attacker-controlled artifacts or files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 数据处理
pandas>=2.0.0
scikit-learn>=1.3.0
scipy>=1.11.0

# AI/机器学习
torch>=2.0.0

• Confidence: 90% confidence
• Finding: Using 'scipy>=1.11.0' is a dependency hygiene weakness because it leaves the actual installed version open-ended. The direct exploitability is usually lower than request-facing libraries, but reproducibility and supply-chain control still suffer.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

scipy>=1.11.0

# AI/机器学习
torch>=2.0.0
torchvision>=0.15.0
tensorflow>=2.13.0  # 可选，用于某些高级功能

• Confidence: 93% confidence
• Finding: PyTorch is unpinned, which increases the risk of accidental adoption of insecure or incompatible releases. This is more concerning in ML skills because model-loading ecosystems and native extensions can expose high-impact attack paths if vulnerable versions are installed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# AI/机器学习
torch>=2.0.0
torchvision>=0.15.0
tensorflow>=2.13.0  # 可选，用于某些高级功能

# Web和API

• Confidence: 90% confidence
• Finding: An unpinned torchvision dependency weakens reproducibility and can pull in unexpected versions that may not match the pinned torch ecosystem. This primarily raises operational and supply-chain risk rather than constituting an immediate standalone exploit.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

tensorflow>=2.13.0  # 可选，用于某些高级功能

# Web和API
requests>=2.31.0
aiohttp>=3.8.0
websockets>=12.0

• Confidence: 94% confidence
• Finding: Using 'requests>=2.31.0' leaves the installed version uncontrolled and may expose the application to future vulnerable releases or resolver inconsistencies. Because this package handles outbound HTTP, dependency hygiene directly affects credential handling, TLS behavior, and SSRF-related controls.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Web和API
requests>=2.31.0
aiohttp>=3.8.0
websockets>=12.0

# 工具和工具类

• Confidence: 94% confidence
• Finding: An unpinned aiohttp dependency creates non-deterministic installs in a network-facing asynchronous HTTP stack. Since this kind of package processes untrusted remote input, version drift can have direct security consequences.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Web和API
requests>=2.31.0
aiohttp>=3.8.0
websockets>=12.0

# 工具和工具类
python-dotenv>=1.0.0

• Confidence: 93% confidence
• Finding: Using 'websockets>=12.0' permits uncontrolled upgrades in a package that handles persistent network connections and attacker-controlled frames. That makes the lack of exact version pinning more security-relevant than for purely local tooling.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

websockets>=12.0

# 工具和工具类
python-dotenv>=1.0.0
pyyaml>=6.0
colorama>=0.4.0
tqdm>=4.65.0

• Confidence: 88% confidence
• Finding: python-dotenv is unpinned, so builds are not reproducible and may absorb future vulnerable or incompatible releases. The immediate security impact is lower than request-facing packages, but it still affects configuration integrity and supply-chain hygiene.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 工具和工具类
python-dotenv>=1.0.0
pyyaml>=6.0
colorama>=0.4.0
tqdm>=4.65.0

• Confidence: 94% confidence
• Finding: PyYAML specified as '>=6.0' allows uncontrolled version selection in a library with a history of unsafe deserialization issues. In any application that may parse YAML from external or semi-trusted sources, exact version control is important to reduce risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 工具和工具类
python-dotenv>=1.0.0
pyyaml>=6.0
colorama>=0.4.0
tqdm>=4.65.0

# 测试和开发

• Confidence: 84% confidence
• Finding: colorama is unpinned, which is a dependency hygiene issue but not usually a major direct security concern. The main risk is non-reproducible environments and minor supply-chain exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv>=1.0.0
pyyaml>=6.0
colorama>=0.4.0
tqdm>=4.65.0

# 测试和开发
pytest>=7.4.0

• Confidence: 87% confidence
• Finding: Using 'tqdm>=4.65.0' leaves installations open-ended and makes the environment harder to audit. While tqdm is not usually a core attack surface, dependency drift still increases supply-chain uncertainty.

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.