Image Watermark

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 1.0.1

Overview

This skill coherently adds watermarks to user-provided images, with some ordinary privacy and dependency-installation cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable processing the selected images with Pillow and receiving the results through WeCom. Avoid submitting sensitive images unless your WeCom environment and retention policies are acceptable, and install dependencies from trusted, preferably pinned sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82

Finding

Unpinned Third-Party Dependencies Installed from Mutable Package Repositories

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82-84
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown

### Dependencies
- `Pillow` (pip3 install Pillow)
- Chinese font: `wqy-zenhei` (`apt install fonts-wqy-zenhei`)

Technical Analysis

The skill directs the agent to install Pillow and a system font without pinning package versions or verifying package integrity. Commands such as pip3 install Pillow resolve whichever compatible release the configured package repository supplies at installation time. The reviewed skill therefore does not fully determine the code that will ultimately be installed and executed.

The system package instruction similarly omits a version constraint and repository trust requirements. Although no malicious dependency is included in the audited project and the package names do not appear to be typographical imitations, using mutable, unverified dependency sources creates supply-chain exposure. A compromised repository, compromised package release, malicious package-index configuration, or unexpected future dependency change could introduce code that was not covered by this audit.

Attack Path

1. A user invokes the image-watermarking skill on a host where the stated dependencies are unavailable.
2. The agent follows the dependency instructions and runs pip3 install Pillow and potentially apt install fonts-wqy-zenhei.
3. The package managers resolve packages using the host's currently configured repositories, mirrors, and version-selection rules.
4. If a selected repository, mirror, package release, or local package-manager configuration has been compromised, attacker-controlled package content is downloaded.
5. Malicious package installation behavior or subsequently imported library code executes with the privileges of the package installation or skill runtime.

This is a conditional supply-chain att ...[truncated 830 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin Pillow to a specifically reviewed version rather than installing the latest available release, for example through a locked requirements file.
2. Use cryptographic hash verification, such as pip's --require-hashes, and obtain artifacts only from an explicitly trusted package index.
3. Pin the system package version where practical and document the trusted operating-system repository and supported distribution release.
4. Do not install dependencies automatically during ordinary skill execution. Detect missing dependencies and request explicit operator approval before changing the environment.
5. Prefer a prebuilt, reproducible, minimally privileged runtime image containing audited dependencies.
6. Run image processing in a sandbox with restricted filesystem and network access, and never grant package installation privileges to the normal skill runtime.
7. Add dependency inventory and vulnerability scanning to the release process, and review dependency updates before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation rule says the skill triggers whenever a user sends an image and asks to add a watermark, but it does not define boundaries, exclusions, or negative examples. This broad natural-language condition could overlap with ordinary conversation and cause unintended invocation when users discuss watermarking in general.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that processed images will be sent through WeCom but does not clearly warn users that their uploaded images and generated outputs are transmitted via that external messaging channel. This creates a privacy and data-handling transparency risk, especially if users submit sensitive or regulated images without understanding where the content will be sent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language instructions, triggers, inputs, and outputs are all presented only in Chinese, which can amount to an implicit language restriction without user opt-in. The file does not state that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.