Security audit
Security checks for vulnerabilities and agentic risk
This AdsTurbo image skill is mostly coherent, but it promotes watermark removal and broad public uploads without enough user-control or authorization boundaries.
Install only if you are comfortable sending prompts, image URLs, and any uploaded local files to AdsTurbo. Avoid using it to remove watermarks, logos, credits, or other provenance marks unless you own the content or have explicit authorization, and do not upload sensitive local files unless making them externally accessible is acceptable.
The skill instructs the agent to send prompts and public image URLs to the AdsTurbo API but does not clearly warn users up front that their content will be transmitted to an external third-party service. This creates a privacy and consent issue, especially for user-supplied images, product assets, or potentially sensitive prompt content.
The skill advertises very broad trigger phrases such as 'generate an image', 'edit image', and 'upscale image', which are common requests that may appear in many contexts. This can cause unintended invocation of the skill, sending user prompts or image URLs to the AdsTurbo service when the user did not specifically intend to use this third-party integration.
The Chinese version omits a clear disclosure that user prompts and image URLs are sent to a third-party provider. Chinese-speaking users therefore receive weaker notice and may unknowingly share content with an external service, creating inconsistent privacy protections across languages.
The Chinese trigger phrases are similarly broad and map to common image-editing requests without clear boundaries. This increases the chance of accidental activation for Chinese-language users, with the same risk of unintended third-party data transfer or tool execution.
The documentation explicitly advertises watermark removal as a standard supported use case without any restriction, ownership check, or abuse warning. That normalizes a capability commonly used to strip attribution, licensing marks, or provenance indicators from third-party content, increasing the likelihood of misuse.
Presenting watermark removal as a routine image-retouching operation lowers friction for abuse and frames potentially unlawful attribution removal as an ordinary workflow. In a reusable agent skill, that can encourage downstream agents or users to invoke the feature without considering rights, consent, or authenticity implications.
The Chinese example repeats and reinforces the same unsafe pattern by showing watermark removal as an ordinary default example. Duplicating the guidance across languages broadens reach and further normalizes misuse for a wider user base.
The instructions explicitly tell users to upload local files so they become publicly accessible URLs, but they do not warn that this transmits potentially sensitive local content to a third-party service and may expose it via a public link. This can cause unintended disclosure of private images, audio, or video, especially because the skill normalizes uploading as a routine prerequisite before downstream operations.
The file explicitly exposes an erase command described as able to 'remove watermarks / objects', which facilitates circumvention of ownership and licensing controls on images. Even if intended as a general retouching tool, presenting watermark removal as a normal feature materially increases misuse risk and may enable copyright infringement or content provenance evasion.
This code sends user-provided prompts and image URLs to external HTTP endpoints via client.post, but the file does not include any confirmation prompt, print/log disclosure, or explicit warning comment about that data transmission. For a code file, network calls that transmit user data should have some visible disclosure unless already clearly warned elsewhere, which is not evident from this file alone.
The cutout, ecommerce, poster, erase, and upscale handlers all send user-supplied image URLs, text fields, and related metadata to remote API endpoints using submit_and_maybe_poll. The file contains no confirmation prompt, user-facing disclosure, or explicit warning that potentially sensitive media and descriptive content will be transmitted off-system.
This script is explicitly designed to upload a local file to a remote service and the module docstring says it returns a public URL, but there is no user-facing warning, confirmation, or visibility into the destination and exposure implications. In a CLI utility, that creates a real risk of users unintentionally transmitting sensitive local files and making them externally accessible, especially because the helper abstracts the network action behind a simple path argument.
The file includes a full Chinese section alongside English, but it does not explicitly tell users they may choose their preferred language/locale or explain any locale policy. Because locale-related policy findings apply to all file types, documentation that appears to steer usage toward a specific language without opt-in can be a policy concern.
The file duplicates the instructions in Chinese after presenting them in English, which implies a fixed language presentation rather than offering a user-selectable locale. Under the policy rule, hard-coded language behavior can be a violation when no opt-in or justification for the locale constraint is provided.
The ecommerce request includes a language field that can constrain generated output to a specific language, but this file provides no surrounding guidance about user opt-in, default behavior, or justification for locale control. Under the policy rule, forcing or steering language without explicit user choice can be problematic when not clearly documented.
The poster command passes a language parameter to the backend, which can enforce a language/locale choice, but the file does not explain whether this is user-selected, optional, or restricted for a justified regional use case. That creates a potential natural-language policy concern around locale steering without explicit opt-in.
