📦
Audit History
faceswap - 7 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v7 Latest | Jul 7, 2026, 07:49 AM | 2 confirmed | 29 | No capability change |
| v6 | Jul 7, 2026, 07:49 AM | 2 confirmed | 29 | No capability change |
| v5 | Jun 30, 2026, 10:20 PM | No confirmed findings | 4 | No capability change |
| v4 | Jun 30, 2026, 10:20 PM | No confirmed findings | 4 | No capability change |
| v3 | Jun 8, 2026, 11:50 AM | No confirmed findings | 2 | No capability change |
| v2 | Mar 18, 2026, 06:56 AM | No confirmed findings | 0 | No capability change |
| v1 | Mar 17, 2026, 04:11 PM | No confirmed findings | 1 | Baseline |
Audit version 7 Latest
Jul 7, 2026, 07:49 AM
The skill is a legitimate verging.ai face-swap workflow, but it performs real outbound network calls, external media processing commands, API-key handling, and temporary file storage. Many Markdown backtick findings are false positives, while the confirmed risks center on credential exposure in curl commands, third-party upload of biometric media, and arbitrary remote media inputs.
2
Files scanned
225
Lines analyzed
35
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Potential Non-Consensual Face Swap Misuse
The skill accepts arbitrary video and face image inputs, then creates a face-swap job. It only reminds users to process media they have rights to, so misuse for impersonation or non-consensual synthetic media remains possible.
The documented options accept any video and face image path or URL, and the create-job step uploads the face image directly. The rights reminder is helpful but does not enforce consent.
High
Biometric Media Sent to Third-Party Services
The workflow uploads video and face images to verging.ai and storage URLs, then returns external result locations. This creates privacy exposure for biometric media beyond the local machine.
The upload and create-job steps explicitly transfer user media to remote API and storage endpoints. The response examples show externally hosted upload and result URLs.
Capability review items (29)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys · 2 occurrences
curl -H "Authorization: ApiKey $VERGING_API_KEY" \
The command expands $VERGING_API_KEY into an Authorization header for curl. This is expected API authentication, but a live secret is handled in command-line arguments.
High
Generic API/secret keys · 2 occurrences
-H "Authorization: ApiKey $VERGING_API_KEY" \
The upload URL request expands $VERGING_API_KEY into a curl Authorization header. This handles a live credential in command-line arguments.
Medium
SKILL.md:48-54SKILL.md:61-64SKILL.md:68-74SKILL.md:87-91SKILL.md:94-104SKILL.md:108-111SKILL.md:122-124
Ruby/shell backtick execution · 7 occurrences
```bash
This Markdown block instructs use of curl to call verging.ai authentication endpoints with an Authorization header. It is intended behavior, but it executes a network command and handles an API credential.
Medium
Ruby/shell backtick execution
- Video URL → `yt-dlp "URL" -o /tmp/verging-faceswap/input.mp4`
The workflow instructs yt-dlp to download a user-provided video URL into /tmp. Running a downloader on arbitrary URLs is a real external-command risk.
Medium
Ruby/shell backtick execution
- Image URL → `curl -L -o /tmp/verging-faceswap/face.jpg "URL"`
The workflow instructs curl to download a user-provided image URL into /tmp. This can retrieve arbitrary remote content through an external command.
Medium
Ruby/shell backtick execution
3. **Get video duration** → `ffprobe -v error -show_entries format=duration -of default=noprint_wrap
The workflow instructs ffprobe to parse a user-provided video file. External media parsers increase local attack surface when processing untrusted files.
Medium
Temp directory access
curl -X PUT -T /tmp/verging-faceswap/trimmed.mp4 \
The command reads a predictable /tmp path and uploads it. This can expose sensitive media if permissions or cleanup are weak.
Medium
Temp directory access
-F "swap_image=@/tmp/verging-faceswap/face.jpg" \
The multipart upload reads face.jpg from a fixed /tmp directory. It handles biometric data from a shared temporary path.
Medium
Temp directory access
- Video URL → `yt-dlp "URL" -o /tmp/verging-faceswap/input.mp4`
yt-dlp writes user media to a fixed /tmp path. Predictable temp locations can collide or leak media on shared hosts.
Medium
Temp directory access
- Image URL → `curl -L -o /tmp/verging-faceswap/face.jpg "URL"`
curl writes a user-provided face image to a fixed /tmp path. That temp file may contain sensitive biometric data.
Medium
Temp directory access
ffmpeg -i input.mp4 -ss <start> -to <end> -c:v libx264 -c:a aac /tmp/verging-faceswap/trimmed.mp4
ffmpeg writes the trimmed video to a fixed /tmp path. The file can contain sensitive media and needs private permissions and cleanup.
Medium
Temp directory access
- **Temp directory: `/tmp/verging-faceswap/`** — create with `mkdir -p`
The skill instructs creation of a fixed temp directory under /tmp. Without a private mktemp-style directory, this is a real temp-file safety risk.
Low
Hardcoded URL
/faceswap -v "https://youtube.com/watch?v=xxx" -f "https://example.com/face.jpg"
The usage example accepts a YouTube URL and a remote face-image URL. This confirms the skill can fetch arbitrary remote resources, so network access is real.
Low
Hardcoded URL
curl -H "Authorization: ApiKey vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me
The command calls the verging.ai auth endpoint with an API-key header. The URL is expected for the service, but it confirms outbound network activity with credentials.
Low
Hardcoded URL
curl -H "Authorization: Bearer vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me
The command calls the same verging.ai auth endpoint using a Bearer header. It confirms intentional outbound network access with a credential-bearing request.
Low
Hardcoded URL
https://verging.ai/api/v1/auth/me
The cited endpoint is used by curl to check account credits. It confirms the skill contacts the verging.ai API during normal operation.
Low
Hardcoded URL
curl -X POST https://verging.ai/api/v1/upload-video \
The command posts to verging.ai to obtain a video upload URL. This is a real outbound network operation for user media.
Low
Hardcoded URL
"url": "https://...r2.cloudflarestorage.com/...?X-Amz-...",
The response example shows a presigned Cloudflare R2 storage URL. This confirms third-party storage endpoints are part of the upload flow.
Low
Hardcoded URL
"public_url": "https://img.panpan8.com/face-swap/2026-05-31/xxx.mp4"
The response example shows a public media URL on img.panpan8.com. That indicates generated or uploaded media may be available through external URLs.
Low
Hardcoded URL
curl -X POST https://verging.ai/api/v1/faceswap/create-job \
The command posts the face-swap job to verging.ai with multipart media. This is a real outbound API call carrying user-provided face data.
Low
Hardcoded URL
"https://verging.ai/api/v1/faceswap/jobs?job_ids=295"
The command polls a verging.ai job status endpoint. It is expected, but confirms ongoing outbound network access during the workflow.
Risk Factors
🌐 Network access (11)
🔑 Env variables (9)
⚙️ External commands (31)
SKILL.md:27-29 SKILL.md:29-46 SKILL.md:46-48 SKILL.md:48-54 SKILL.md:54-61 SKILL.md:61-64 SKILL.md:64-65 SKILL.md:65-68 SKILL.md:68-74 SKILL.md:74-76 SKILL.md:76-84 SKILL.md:84-87 SKILL.md:87-91 SKILL.md:91-94 SKILL.md:94-104 SKILL.md:104-105 SKILL.md:105-108 SKILL.md:108-111 SKILL.md:111-112 SKILL.md:112-118 SKILL.md:118-119 SKILL.md:119-120 SKILL.md:120-122 SKILL.md:122-124 SKILL.md:124-127 SKILL.md:127-133 SKILL.md:133 SKILL.md:135-136 SKILL.md:136 SKILL.md:138 SKILL.md:150-153
📁 Filesystem access (7)
Audited by: codex
Jul 7, 2026, 07:49 AM
The skill is a legitimate verging.ai face-swap workflow, but it performs real outbound network calls, external media processing commands, API-key handling, and temporary file storage. Many Markdown backtick findings are false positives, while the confirmed risks center on credential exposure in curl commands, third-party upload of biometric media, and arbitrary remote media inputs.
2
Files scanned
225
Lines analyzed
35
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Potential Non-Consensual Face Swap Misuse
The skill accepts arbitrary video and face image inputs, then creates a face-swap job. It only reminds users to process media they have rights to, so misuse for impersonation or non-consensual synthetic media remains possible.
The documented options accept any video and face image path or URL, and the create-job step uploads the face image directly. The rights reminder is helpful but does not enforce consent.
High
Biometric Media Sent to Third-Party Services
The workflow uploads video and face images to verging.ai and storage URLs, then returns external result locations. This creates privacy exposure for biometric media beyond the local machine.
The upload and create-job steps explicitly transfer user media to remote API and storage endpoints. The response examples show externally hosted upload and result URLs.
Capability review items (29)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys · 2 occurrences
curl -H "Authorization: ApiKey $VERGING_API_KEY" \
The command expands $VERGING_API_KEY into an Authorization header for curl. This is expected API authentication, but a live secret is handled in command-line arguments.
High
Generic API/secret keys · 2 occurrences
-H "Authorization: ApiKey $VERGING_API_KEY" \
The upload URL request expands $VERGING_API_KEY into a curl Authorization header. This handles a live credential in command-line arguments.
Medium
SKILL.md:48-54SKILL.md:61-64SKILL.md:68-74SKILL.md:87-91SKILL.md:94-104SKILL.md:108-111SKILL.md:122-124
Ruby/shell backtick execution · 7 occurrences
```bash
This Markdown block instructs use of curl to call verging.ai authentication endpoints with an Authorization header. It is intended behavior, but it executes a network command and handles an API credential.
Medium
Ruby/shell backtick execution
- Video URL → `yt-dlp "URL" -o /tmp/verging-faceswap/input.mp4`
The workflow instructs yt-dlp to download a user-provided video URL into /tmp. Running a downloader on arbitrary URLs is a real external-command risk.
Medium
Ruby/shell backtick execution
- Image URL → `curl -L -o /tmp/verging-faceswap/face.jpg "URL"`
The workflow instructs curl to download a user-provided image URL into /tmp. This can retrieve arbitrary remote content through an external command.
Medium
Ruby/shell backtick execution
3. **Get video duration** → `ffprobe -v error -show_entries format=duration -of default=noprint_wrap
The workflow instructs ffprobe to parse a user-provided video file. External media parsers increase local attack surface when processing untrusted files.
Medium
Temp directory access
curl -X PUT -T /tmp/verging-faceswap/trimmed.mp4 \
The command reads a predictable /tmp path and uploads it. This can expose sensitive media if permissions or cleanup are weak.
Medium
Temp directory access
-F "swap_image=@/tmp/verging-faceswap/face.jpg" \
The multipart upload reads face.jpg from a fixed /tmp directory. It handles biometric data from a shared temporary path.
Medium
Temp directory access
- Video URL → `yt-dlp "URL" -o /tmp/verging-faceswap/input.mp4`
yt-dlp writes user media to a fixed /tmp path. Predictable temp locations can collide or leak media on shared hosts.
Medium
Temp directory access
- Image URL → `curl -L -o /tmp/verging-faceswap/face.jpg "URL"`
curl writes a user-provided face image to a fixed /tmp path. That temp file may contain sensitive biometric data.
Medium
Temp directory access
ffmpeg -i input.mp4 -ss <start> -to <end> -c:v libx264 -c:a aac /tmp/verging-faceswap/trimmed.mp4
ffmpeg writes the trimmed video to a fixed /tmp path. The file can contain sensitive media and needs private permissions and cleanup.
Medium
Temp directory access
- **Temp directory: `/tmp/verging-faceswap/`** — create with `mkdir -p`
The skill instructs creation of a fixed temp directory under /tmp. Without a private mktemp-style directory, this is a real temp-file safety risk.
Low
Hardcoded URL
/faceswap -v "https://youtube.com/watch?v=xxx" -f "https://example.com/face.jpg"
The usage example accepts a YouTube URL and a remote face-image URL. This confirms the skill can fetch arbitrary remote resources, so network access is real.
Low
Hardcoded URL
curl -H "Authorization: ApiKey vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me
The command calls the verging.ai auth endpoint with an API-key header. The URL is expected for the service, but it confirms outbound network activity with credentials.
Low
Hardcoded URL
curl -H "Authorization: Bearer vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me
The command calls the same verging.ai auth endpoint using a Bearer header. It confirms intentional outbound network access with a credential-bearing request.
Low
Hardcoded URL
https://verging.ai/api/v1/auth/me
The cited endpoint is used by curl to check account credits. It confirms the skill contacts the verging.ai API during normal operation.
Low
Hardcoded URL
curl -X POST https://verging.ai/api/v1/upload-video \
The command posts to verging.ai to obtain a video upload URL. This is a real outbound network operation for user media.
Low
Hardcoded URL
"url": "https://...r2.cloudflarestorage.com/...?X-Amz-...",
The response example shows a presigned Cloudflare R2 storage URL. This confirms third-party storage endpoints are part of the upload flow.
Low
Hardcoded URL
"public_url": "https://img.panpan8.com/face-swap/2026-05-31/xxx.mp4"
The response example shows a public media URL on img.panpan8.com. That indicates generated or uploaded media may be available through external URLs.
Low
Hardcoded URL
curl -X POST https://verging.ai/api/v1/faceswap/create-job \
The command posts the face-swap job to verging.ai with multipart media. This is a real outbound API call carrying user-provided face data.
Low
Hardcoded URL
"https://verging.ai/api/v1/faceswap/jobs?job_ids=295"
The command polls a verging.ai job status endpoint. It is expected, but confirms ongoing outbound network access during the workflow.
Risk Factors
🌐 Network access (11)
🔑 Env variables (9)
⚙️ External commands (31)
SKILL.md:27-29 SKILL.md:29-46 SKILL.md:46-48 SKILL.md:48-54 SKILL.md:54-61 SKILL.md:61-64 SKILL.md:64-65 SKILL.md:65-68 SKILL.md:68-74 SKILL.md:74-76 SKILL.md:76-84 SKILL.md:84-87 SKILL.md:87-91 SKILL.md:91-94 SKILL.md:94-104 SKILL.md:104-105 SKILL.md:105-108 SKILL.md:108-111 SKILL.md:111-112 SKILL.md:112-118 SKILL.md:118-119 SKILL.md:119-120 SKILL.md:120-122 SKILL.md:122-124 SKILL.md:124-127 SKILL.md:127-133 SKILL.md:133 SKILL.md:135-136 SKILL.md:136 SKILL.md:138 SKILL.md:150-153
📁 Filesystem access (7)
Audited by: codex
Jun 30, 2026, 10:20 PM
Static analysis flagged command execution, network access, API key handling, temporary file use, and weak-crypto matches. Review confirmed the command, network, credential, and filesystem risks as intended but security-sensitive behavior for a media upload workflow. No prompt injection or malicious intent was found, and the weak cryptography alerts are false positives.
2
Files scanned
225
Lines analyzed
8
Review items
1
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
External Tool Execution With User-Supplied Media Inputs
The skill instructs the agent to run npx, yt-dlp, curl, ffprobe, and ffmpeg commands using user-provided paths and URLs. This is required for the workflow, but it creates command execution and input handling risk if arguments are not quoted or validated.
The files directly document shell commands that process user-controlled video and image inputs. The commands are normal for this skill, so the risk is operational rather than evidence of malicious intent.
Medium
External API Uploads Include Sensitive Media and Credentials
The workflow sends an API key in Authorization headers and uploads video and face image data to verging.ai and a presigned storage URL. This behavior is disclosed and central to the service, but users must understand that personal media leaves the local machine.
The API key header and multipart upload instructions are explicit. The endpoints appear aligned with the claimed face swap service, which reduces concern about malicious exfiltration.
Medium
Temporary Media Files Stored Under /tmp
The instructions place downloaded, trimmed, and uploaded media under /tmp/verging-faceswap. Temporary storage is practical, but face images and videos may remain readable until cleanup is performed.
Multiple instructions reference the same temporary directory and media filenames. The skill also tells users to clean up, so the issue is a privacy hygiene concern.
Low
Hardcoded Service URLs Are Expected API Documentation
The static analyzer flagged verging.ai, YouTube, and example URL references. These links document the intended external service and example inputs, with no evidence of hidden endpoints.
The URLs are visible user-facing documentation for the advertised service. I did not find evidence that they are concealed or unrelated to the skill.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Cryptography Alerts Are False Positives
Static analysis reported weak cryptographic algorithm matches, but the referenced lines describe face swap metadata or a Markdown table. No evidence of cryptographic code was found.
The cited lines contain natural language or Markdown formatting, not hash or cipher usage. This makes the weak-crypto finding highly likely to be a scanner false positive.
Risk Factors
⚙️ External commands (5)
🌐 Network access (8)
🔑 Env variables (9)
📁 Filesystem access (7)
Detected Patterns
Command Execution Plus Network Upload Workflow
Audited by: codex
Jun 30, 2026, 10:20 PM
Static analysis flagged command execution, network access, API key handling, temporary file use, and weak-crypto matches. Review confirmed the command, network, credential, and filesystem risks as intended but security-sensitive behavior for a media upload workflow. No prompt injection or malicious intent was found, and the weak cryptography alerts are false positives.
2
Files scanned
225
Lines analyzed
8
Review items
1
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
External Tool Execution With User-Supplied Media Inputs
The skill instructs the agent to run npx, yt-dlp, curl, ffprobe, and ffmpeg commands using user-provided paths and URLs. This is required for the workflow, but it creates command execution and input handling risk if arguments are not quoted or validated.
The files directly document shell commands that process user-controlled video and image inputs. The commands are normal for this skill, so the risk is operational rather than evidence of malicious intent.
Medium
External API Uploads Include Sensitive Media and Credentials
The workflow sends an API key in Authorization headers and uploads video and face image data to verging.ai and a presigned storage URL. This behavior is disclosed and central to the service, but users must understand that personal media leaves the local machine.
The API key header and multipart upload instructions are explicit. The endpoints appear aligned with the claimed face swap service, which reduces concern about malicious exfiltration.
Medium
Temporary Media Files Stored Under /tmp
The instructions place downloaded, trimmed, and uploaded media under /tmp/verging-faceswap. Temporary storage is practical, but face images and videos may remain readable until cleanup is performed.
Multiple instructions reference the same temporary directory and media filenames. The skill also tells users to clean up, so the issue is a privacy hygiene concern.
Low
Hardcoded Service URLs Are Expected API Documentation
The static analyzer flagged verging.ai, YouTube, and example URL references. These links document the intended external service and example inputs, with no evidence of hidden endpoints.
The URLs are visible user-facing documentation for the advertised service. I did not find evidence that they are concealed or unrelated to the skill.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Cryptography Alerts Are False Positives
Static analysis reported weak cryptographic algorithm matches, but the referenced lines describe face swap metadata or a Markdown table. No evidence of cryptographic code was found.
The cited lines contain natural language or Markdown formatting, not hash or cipher usage. This makes the weak-crypto finding highly likely to be a scanner false positive.
Risk Factors
⚙️ External commands (5)
🌐 Network access (8)
🔑 Env variables (9)
📁 Filesystem access (7)
Detected Patterns
Command Execution Plus Network Upload Workflow
Audited by: codex
Jun 8, 2026, 11:50 AM
The skill is a documentation/instruction file (no executable code) that guides an AI assistant to run shell commands (yt-dlp, ffmpeg, curl) and make API calls to verging.ai. All 82 static findings are false positives in context: backtick patterns are markdown code examples, URLs are legitimate API endpoints, API key references are standard authentication documentation, and temp directory access is standard media processing. The combination of network + credentials + external commands is expected for this use case. No malicious intent detected. Risk level is medium due to the breadth of system access required.
2
Files scanned
225
Lines analyzed
6
Review items
3
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Broad system access required
The skill requires yt-dlp, ffmpeg, ffprobe, and curl binaries plus the VERGING_API_KEY environment variable. While all usages are documented and legitimate for face-swap workflows, the combination of network access, external command execution, credential handling, and filesystem write access represents a significant attack surface if the skill were modified maliciously. This is a known characteristic of media-processing skills, not a current vulnerability.
Low
Temp directory usage in /tmp
The skill uses /tmp/verging-faceswap/ for intermediate video and image files. This is standard practice for media processing but files may persist if not cleaned up. The documentation recommends cleanup. Low risk.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Static analyzer false positives: backtick patterns
The static scanner flagged 44 instances of 'Ruby/shell backtick execution' in markdown files. These are all code-block examples in documentation showing curl, ffmpeg, and yt-dlp commands. They are not executable code in the skill itself. False positive.
Low
Static analyzer false positives: hardcoded URLs
17 URL references flagged as suspicious are all legitimate API endpoints (verging.ai/api/v1/*) and documentation links. False positive.
Low
Static analyzer false positives: weak cryptography
The 'weak cryptographic algorithm' findings at SKILL.md:3 and SKILL.md:33 are likely false positives triggered by the term 'key' in API key context or video codec references (libx264). No actual cryptographic operations are performed by the skill.
Risk Factors
⚙️ External commands (5)
🌐 Network access (5)
🔑 Env variables (3)
📁 Filesystem access (3)
Audited by: claude
Mar 18, 2026, 06:56 AM
This is a legitimate face swap API client skill. The static findings reflect expected behavior: network calls to the verging.ai API service, environment variable access for API key authentication, and external command execution for video processing tools (yt-dlp, ffmpeg, curl). These are all necessary for the skill's core functionality. No malicious intent detected.
4
Files scanned
347
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
🌐 Network access (18)
🔑 Env variables (16)
⚙️ External commands (36)
SKILL.md:28-30 SKILL.md:30-63 SKILL.md:63-65 SKILL.md:65-67 SKILL.md:67-72 SKILL.md:72-78 SKILL.md:78-84 SKILL.md:84-134 SKILL.md:134-137 SKILL.md:137-138 SKILL.md:138 SKILL.md:138 SKILL.md:138-144 SKILL.md:144-145 SKILL.md:145-146 SKILL.md:146-157 SKILL.md:157 SKILL.md:157-167 SKILL.md:167-168 SKILL.md:168-179 SKILL.md:179-181 SKILL.md:181-183 SKILL.md:183-185 SKILL.md:185-194 SKILL.md:194 SKILL.md:194 SKILL.md:194-197 SKILL.md:197-201 SKILL.md:201-204 SKILL.md:204-205 SKILL.md:205-206 SKILL.md:206-207 SKILL.md:207-208 SKILL.md:208-209 SKILL.md:209-276 SKILL.md:276-281
📁 Filesystem access (3)
Audited by: claude
Mar 17, 2026, 04:11 PM
Static analysis flagged 77 patterns but all are false positives. Network URLs point to documented verging.ai API endpoints. Environment variable access is for user-provided API key authentication. Shell commands in SKILL.md are markdown documentation examples, not executable code. Temp directory usage is documented with cleanup. Skill is a legitimate CLI wrapper for a paid AI service.
4
Files scanned
341
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Low
Temporary File Storage
Skill uses /tmp/verging-faceswap/ directory for temporary video and image files during processing. Files are documented to be cleaned up after processing but temporary storage of user media could pose privacy risks if cleanup fails.
Risk Factors
🌐 Network access (18)
🔑 Env variables (16)
⚙️ External commands (32)
SKILL.md:28-30 SKILL.md:30-63 SKILL.md:63-65 SKILL.md:65-67 SKILL.md:67-72 SKILL.md:72-78 SKILL.md:78-84 SKILL.md:84-134 SKILL.md:134-137 SKILL.md:137-138 SKILL.md:138 SKILL.md:138 SKILL.md:138 SKILL.md:138-143 SKILL.md:143-163 SKILL.md:163-173 SKILL.md:173-175 SKILL.md:175-177 SKILL.md:177-179 SKILL.md:179-188 SKILL.md:188 SKILL.md:188 SKILL.md:188-191 SKILL.md:191-195 SKILL.md:195-198 SKILL.md:198-199 SKILL.md:199-200 SKILL.md:200-201 SKILL.md:201-202 SKILL.md:202-203 SKILL.md:203-270 SKILL.md:270-275
📁 Filesystem access (2)
Audited by: claude