AdsTurbo AI 图片创作 · AdsTurbo AI Image Creation

• Outcome: Review
• Latest audit: Aug 26, 2026 · 10:30 AM UTC
• Version: 1.1.1

Overview

The skill mostly does what it says, but it repeatedly promotes watermark removal without ownership or permission limits and sends user media to an external service as public URLs.

Review this skill before installing if you plan to use it with third-party media. Only use watermark or mark removal on content you own or are authorized to edit, avoid uploading sensitive local files unless you accept them being sent to AdsTurbo and returned as public URLs, and prefer a pinned safe requests version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly markets watermark removal as a supported use case but provides no limitation that the user must own the image or have authorization to remove the mark. That omission lowers friction for copyright circumvention and misuse, especially because the capability is presented alongside normal editing tasks as a routine feature.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example command gives a concrete watermark-removal instruction without any accompanying legality or authorization warning, which operationalizes misuse rather than merely mentioning the capability. Example-driven guidance makes abuse easier by showing exactly how to invoke the function on an arbitrary image URL.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Chinese section repeats the watermark-removal capability without any permitted-use warning, extending the same unsafe guidance to another audience. Because the skill is bilingual, the absence of safeguards in both languages broadens the likelihood of unauthorized copyright-mark removal.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly presents watermark removal as a normal supported use case without any warning about copyright, ownership, or authorization requirements. This can facilitate misuse for removing attribution or rights-management marks from third-party images, which increases legal and policy risk and normalizes potentially unlawful behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Chinese-language documentation mirrors the same issue by instructing users to remove watermarks as part of standard image retouching, again without any compliance or authorization warning. Because it is presented as ordinary usage guidance, it lowers friction for abusive use across another language audience.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guidance instructs users to upload local assets so they become publicly accessible URLs, but it does not clearly warn that this can expose private images, audio, video, or embedded metadata to a third-party service and potentially to anyone with the resulting URL. In a workflow centered on user-provided media, omission of a privacy warning materially increases the risk of accidental disclosure of sensitive content.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The document mentions authenticated multipart uploads but does not tell users that files and associated metadata are sent over the network to an external API provider. While this is partly implicit in 'upload,' the lack of an explicit disclosure can still lead users to unknowingly transmit sensitive material, especially in agent-driven workflows where actions may feel local or automated.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The module docstring advertises an 'erase' capability specifically for 'remove watermarks / objects,' which facilitates removal of ownership or attribution markers from third-party images. In the context of an image-manipulation skill, this is not incidental text: it documents and normalizes a misuse-prone feature that can be used to circumvent content protections and support copyright infringement or fraud.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The CLI help text explicitly promotes the command as 'remove watermark or object,' directly instructing users how to invoke a capability that can strip content ownership markings. Because this is operational user guidance rather than an ambiguous internal comment, it materially increases abuse likelihood by making circumvention easy and discoverable.

Ssd 4

Medium

• Confidence: 92% confidence
• Finding: Framing watermark removal as a routine retouching operation operationalizes a misuse pattern by giving users a direct command example for potentially infringing conduct. In a skill meant to guide image editing actions, this context makes the issue more dangerous because it is actionable, normalized, and easy to reproduce.

Ssd 4

Medium

• Confidence: 92% confidence
• Finding: The Chinese example similarly normalizes watermark removal as a standard feature and provides directly usable instructions for it. This broadens the misuse surface and indicates the problematic guidance is systemic rather than accidental to one locale.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0

• Confidence: 98% confidence
• Finding: The dependency is specified as requests>=2.28.0, which is unpinned and allows installation of different versions across environments and over time. This weakens reproducibility and can unintentionally admit vulnerable or incompatible releases, increasing supply-chain risk.

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Although the file does not explicitly pin requests to 2.28.0, the specifier requests>=2.28.0 permits installation of 2.28.0, which is a version with multiple known advisories. In environments that resolve to that version or cache it, the skill may inherit vulnerabilities such as credential leakage or TLS/session verification issues.

Static analysis

No suspicious patterns detected.