Versioned security assessment
Report ID: SA-36E07D5E
7/7/2026, 7:49:15 AM
faceswap security assessment v6
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- faceswap
- Version
- v6
- Maintainer
- verging.ai
- Coverage
- 2 Files scanned · 225 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
2 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The skill is a legitimate verging.ai face-swap workflow, but it performs real outbound network calls, external media processing commands, API-key handling, and temporary file storage. Many Markdown backtick findings are false positives, while the confirmed risks center on credential exposure in curl commands, third-party upload of biometric media, and arbitrary remote media inputs.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
2 Files scanned · 225 Lines analyzed
31 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 11 evidence locations
Filesystem access
May read or write local files.
Observed in 7 evidence locations
Env variables
May read values from the process environment.
Observed in 9 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 31 evidence locations
Capability review items (29)
High
Generic API/secret keys
curl -H "Authorization: ApiKey $VERGING_API_KEY" \
The command expands $VERGING_API_KEY into an Authorization header for curl. This is expected API authentication, but a live secret is handled in command-line arguments.
High
Generic API/secret keys
-H "Authorization: ApiKey $VERGING_API_KEY" \
The upload URL request expands $VERGING_API_KEY into a curl Authorization header. This handles a live credential in command-line arguments.
High
Generic API/secret keys
-H "Authorization: ApiKey $VERGING_API_KEY" \
The create-job request expands $VERGING_API_KEY while uploading face media. This combines secret handling with external media upload.
High
Generic API/secret keys
curl -H "Authorization: ApiKey $VERGING_API_KEY" \
The job polling command expands $VERGING_API_KEY into a curl header. This is legitimate use, but still exposes a live API key to shell command handling.
Medium
Ruby/shell backtick execution
```bash
This Markdown block instructs use of curl to call verging.ai authentication endpoints with an Authorization header. It is intended behavior, but it executes a network command and handles an API credential.
Medium
Ruby/shell backtick execution
```bash
The cited block runs curl with $VERGING_API_KEY to check credits. This is legitimate API use, but it exposes a secret-bearing header to a shell command.
Medium
Ruby/shell backtick execution
```bash
The block runs curl POST to request an upload URL. It is an external command that uses the user API key and prepares user media for upload.
Medium
Ruby/shell backtick execution
```bash
The block runs curl -T to upload /tmp/verging-faceswap/trimmed.mp4 to a presigned URL. This executes an external command that transfers local media off the machine.
Medium
Ruby/shell backtick execution
```bash
The block runs curl with multipart upload of the face image. It executes an external command that sends biometric media and an API key to the service.
Medium
Ruby/shell backtick execution
```bash
The block runs curl to poll job status against verging.ai. It is expected network behavior, but still an external command issued by the skill workflow.
Medium
Ruby/shell backtick execution
- Video URL → `yt-dlp "URL" -o /tmp/verging-faceswap/input.mp4`
The workflow instructs yt-dlp to download a user-provided video URL into /tmp. Running a downloader on arbitrary URLs is a real external-command risk.
Medium
Ruby/shell backtick execution
- Image URL → `curl -L -o /tmp/verging-faceswap/face.jpg "URL"`
The workflow instructs curl to download a user-provided image URL into /tmp. This can retrieve arbitrary remote content through an external command.
Medium
Ruby/shell backtick execution
3. **Get video duration** → `ffprobe -v error -show_entries format=duration -of default=noprint_wrap
The workflow instructs ffprobe to parse a user-provided video file. External media parsers increase local attack surface when processing untrusted files.
Medium
Ruby/shell backtick execution
```bash
The cited bash block contains the ffmpeg trim command for user media. Executing ffmpeg on untrusted input is a real external-command surface.
Medium
Temp directory access
curl -X PUT -T /tmp/verging-faceswap/trimmed.mp4 \
The command reads a predictable /tmp path and uploads it. This can expose sensitive media if permissions or cleanup are weak.
Medium
Temp directory access
-F "swap_image=@/tmp/verging-faceswap/face.jpg" \
The multipart upload reads face.jpg from a fixed /tmp directory. It handles biometric data from a shared temporary path.
Medium
Temp directory access
- Video URL → `yt-dlp "URL" -o /tmp/verging-faceswap/input.mp4`
yt-dlp writes user media to a fixed /tmp path. Predictable temp locations can collide or leak media on shared hosts.
Medium
Temp directory access
- Image URL → `curl -L -o /tmp/verging-faceswap/face.jpg "URL"`
curl writes a user-provided face image to a fixed /tmp path. That temp file may contain sensitive biometric data.
Medium
Temp directory access
ffmpeg -i input.mp4 -ss <start> -to <end> -c:v libx264 -c:a aac /tmp/verging-faceswap/trimmed.mp4
ffmpeg writes the trimmed video to a fixed /tmp path. The file can contain sensitive media and needs private permissions and cleanup.
Medium
Temp directory access
- **Temp directory: `/tmp/verging-faceswap/`** — create with `mkdir -p`
The skill instructs creation of a fixed temp directory under /tmp. Without a private mktemp-style directory, this is a real temp-file safety risk.
Low
Hardcoded URL
/faceswap -v "https://youtube.com/watch?v=xxx" -f "https://example.com/face.jpg"
The usage example accepts a YouTube URL and a remote face-image URL. This confirms the skill can fetch arbitrary remote resources, so network access is real.
Low
Hardcoded URL
curl -H "Authorization: ApiKey vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me
The command calls the verging.ai auth endpoint with an API-key header. The URL is expected for the service, but it confirms outbound network activity with credentials.
Low
Hardcoded URL
curl -H "Authorization: Bearer vrg_sk_your_key_here" https://verging.ai/api/v1/auth/me
The command calls the same verging.ai auth endpoint using a Bearer header. It confirms intentional outbound network access with a credential-bearing request.
Low
Hardcoded URL
https://verging.ai/api/v1/auth/me
The cited endpoint is used by curl to check account credits. It confirms the skill contacts the verging.ai API during normal operation.
Low
Hardcoded URL
curl -X POST https://verging.ai/api/v1/upload-video \
The command posts to verging.ai to obtain a video upload URL. This is a real outbound network operation for user media.
Low
Hardcoded URL
"url": "https://...r2.cloudflarestorage.com/...?X-Amz-...",
The response example shows a presigned Cloudflare R2 storage URL. This confirms third-party storage endpoints are part of the upload flow.
Low
Hardcoded URL
"public_url": "https://img.panpan8.com/face-swap/2026-05-31/xxx.mp4"
The response example shows a public media URL on img.panpan8.com. That indicates generated or uploaded media may be available through external URLs.
Low
Hardcoded URL
curl -X POST https://verging.ai/api/v1/faceswap/create-job \
The command posts the face-swap job to verging.ai with multipart media. This is a real outbound API call carrying user-provided face data.
Low
Hardcoded URL
"https://verging.ai/api/v1/faceswap/jobs?job_ids=295"
The command polls a verging.ai job status endpoint. It is expected, but confirms ongoing outbound network access during the workflow.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (2)
RISK-001 High
Potential Non-Consensual Face Swap Misuse
The skill accepts arbitrary video and face image inputs, then creates a face-swap job. It only reminds users to process media they have rights to, so misuse for impersonation or non-consensual synthetic media remains possible.
The documented options accept any video and face image path or URL, and the create-job step uploads the face image directly. The rights reminder is helpful but does not enforce consent.
RISK-002 High
Biometric Media Sent to Third-Party Services
The workflow uploads video and face images to verging.ai and storage URLs, then returns external result locations. This creates privacy exposure for biometric media beyond the local machine.
The upload and create-job steps explicitly transfer user media to remote API and storage endpoints. The response examples show externally hosted upload and result URLs.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighConsent and impersonation controls are not enforced.Add explicit consent checks, clear prohibited-use language, and refusal guidance for non-consensual, deceptive, or rights-infringing face swaps.
- FIX-002HighBiometric media is uploaded to third-party services.Disclose upload destinations, retention expectations, result URL visibility, and privacy impact before sending video or face images.
- FIX-003HighAPI keys are passed through curl command-line headers.Use safer credential handling such as restricted config files, stdin-supported tooling, or runtime secret injection that avoids process-list exposure.
- FIX-004MediumRemote URLs are downloaded and parsed by local tools.Validate URL schemes, quote all paths, reject shell metacharacters in implementations, and confirm trusted sources before running yt-dlp, curl, ffprobe, or ffmpeg.
- FIX-005MediumSensitive media is stored in a predictable /tmp directory.Create a private temporary directory with mktemp, set restrictive permissions, and remove files automatically after completion or failure.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable