Pixel Art Processing

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.0

Overview

This pixel-art tool is mostly coherent, but it asks users to run backend tooling that can execute unreviewed local code and affect unrelated local services.

Review before installing. Use the local browser/Python processing paths only with files you trust, avoid running the deploy helper unless you have reviewed the external backend directory it references, do not expose the API on 0.0.0.0 without authentication and firewalling, and only remove watermarks or provenance marks when you have explicit rights to do so.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (20)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The page imports executable JavaScript from third-party CDNs at load time, giving those remote providers the ability to run arbitrary code in the user's browser whenever the tool is opened. Because this tool handles local files and generates downloadable outputs, a compromised CDN, dependency takeover, or network tampering event could exfiltrate user images or silently alter results.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The GIF creation path dynamically injects and executes an additional remote script at runtime, which expands the attack surface beyond initial page load and bypasses any expectation that the tool is fully local. An attacker controlling that CDN response could execute arbitrary code on demand when a user processes frames, including reading selected files and leaking data over the network.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The script enumerates local processes and terminates uvicorn processes, then escalates to killing any process with 'uvicorn' in its command line using SIGKILL. In a multi-project environment this can disrupt unrelated local services, causing denial of service or accidental destruction outside the skill's intended image-processing role.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrases are very broad and include common terms like sprite, pixelate, background removal, and image-editing phrases in multiple languages, making accidental invocation likely. In an agent setting, overbroad triggers can route unrelated user requests into a skill that may prompt local file handling, backend deployment, or other higher-risk operations than the user expected.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly advertises Gemini and Seedance watermark removal without any legal, ownership, or policy warning. That framing can facilitate misuse for copyright circumvention, provenance removal, or deceptive media manipulation, especially because the surrounding context presents it as a standard supported feature rather than a restricted or cautionary operation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The document explicitly instructs users to remove a third-party 'Gemini' watermark as a routine processing step, without any warning about copyright, licensing, attribution, or provenance concerns. In this skill context, that guidance can facilitate misuse of protected or AI-generated assets and normalize removal of origin markers before redistribution.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script force-kills processes with SIGKILL based on loose cmdline matching and gives no warning or confirmation before destructive action. This can terminate unrelated uvicorn services and bypass cleanup handlers, leading to service disruption, data loss, or corruption.

Ssd 4

Medium

• Confidence: 98% confidence
• Finding: The workflow provides operational, step-by-step instructions to remove a third-party watermark before continuing image processing. Because this skill is specifically designed for asset processing and sprite workflows, the instruction is more dangerous than in an abstract discussion: it can directly enable unauthorized reuse, laundering of asset provenance, and downstream redistribution of infringing content.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

基于 FrameRonin: https://github.com/systemchester/FrameRonin
"""
fastapi>=0.104.0
uvicorn[standard]>=0.24.0
python-multipart>=0.0.6
pydantic>=2.5.0

• Confidence: 94% confidence
• Finding: Using a lower-bound specifier like 'fastapi>=0.104.0' allows future installs to resolve to any newer version, including releases with breaking changes or newly introduced vulnerabilities. In supply-chain terms this weakens reproducibility and can unexpectedly expose deployments to insecure or incompatible versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"""
fastapi>=0.104.0
uvicorn[standard]>=0.24.0
python-multipart>=0.0.6
pydantic>=2.5.0
redis>=5.0.0
rq>=1.15.0

• Confidence: 94% confidence
• Finding: An unpinned 'python-multipart>=0.0.6' requirement permits non-reproducible installs and uncontrolled upgrades. For a package that processes attacker-controlled multipart input, this increases the risk of silently picking up insecure or incompatible releases in production.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastapi>=0.104.0
uvicorn[standard]>=0.24.0
python-multipart>=0.0.6
pydantic>=2.5.0
redis>=5.0.0
rq>=1.15.0
ffmpeg-python>=0.2.0

• Confidence: 92% confidence
• Finding: Unpinned pydantic versions make builds non-deterministic and can introduce vulnerable or breaking releases without code changes. Because validation libraries often handle untrusted input, version drift can materially affect security posture.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

uvicorn[standard]>=0.24.0
python-multipart>=0.0.6
pydantic>=2.5.0
redis>=5.0.0
rq>=1.15.0
ffmpeg-python>=0.2.0
rembg>=2.0.50

• Confidence: 91% confidence
• Finding: Unpinned redis client dependencies weaken supply-chain control and allow unexpected versions to be installed. In systems using queues or shared infrastructure, dependency drift can lead to security regressions or operational failures.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-multipart>=0.0.6
pydantic>=2.5.0
redis>=5.0.0
rq>=1.15.0
ffmpeg-python>=0.2.0
rembg>=2.0.50
pillow>=10.0.0

• Confidence: 90% confidence
• Finding: Using 'rq>=1.15.0' leaves worker/runtime behavior dependent on resolver outcomes and future releases. Queue-processing components often deserialize and execute job metadata, so reproducible, vetted versions are important for security and stability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pydantic>=2.5.0
redis>=5.0.0
rq>=1.15.0
ffmpeg-python>=0.2.0
rembg>=2.0.50
pillow>=10.0.0
python-magic-bin>=0.4.14;sys_platform=="win32"

• Confidence: 92% confidence
• Finding: An unpinned ffmpeg-python dependency creates supply-chain uncertainty and non-reproducible installs. Media-processing stacks frequently handle adversarial files, so tightly controlling versions is important to limit exposure from wrapper/library changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

redis>=5.0.0
rq>=1.15.0
ffmpeg-python>=0.2.0
rembg>=2.0.50
pillow>=10.0.0
python-magic-bin>=0.4.14;sys_platform=="win32"
python-magic>=0.4.27;sys_platform!="win32"

• Confidence: 94% confidence
• Finding: Allowing arbitrary newer rembg versions increases the chance of inheriting future security issues or behavior changes without review. Since rembg may process uploaded files and models, weak version control raises practical security risk in this skill context.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rq>=1.15.0
ffmpeg-python>=0.2.0
rembg>=2.0.50
pillow>=10.0.0
python-magic-bin>=0.4.14;sys_platform=="win32"
python-magic>=0.4.27;sys_platform!="win32"
aiofiles>=23.2.0

• Confidence: 95% confidence
• Finding: Pillow processes untrusted image data, so leaving it unpinned is riskier than for many libraries. Resolver-selected versions may introduce known parser flaws or decompression/resource-consumption issues that directly affect this image-processing skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pillow>=10.0.0
python-magic-bin>=0.4.14;sys_platform=="win32"
python-magic>=0.4.27;sys_platform!="win32"
aiofiles>=23.2.0
httpx>=0.25.0
opencv-python-headless>=4.8.0
numpy>=1.24.0

• Confidence: 88% confidence
• Finding: Unpinned aiofiles is mainly a supply-chain hygiene issue rather than a direct exploitable flaw from this file alone. It still reduces reproducibility and can unexpectedly alter file-handling behavior across environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-magic-bin>=0.4.14;sys_platform=="win32"
python-magic>=0.4.27;sys_platform!="win32"
aiofiles>=23.2.0
httpx>=0.25.0
opencv-python-headless>=4.8.0
numpy>=1.24.0

• Confidence: 93% confidence
• Finding: httpx with only a minimum version allows unreviewed future releases to be installed. Because HTTP clients can interact with attacker-influenced URLs or metadata, uncontrolled version drift can amplify SSRF, validation, or request-smuggling related exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-magic>=0.4.27;sys_platform!="win32"
aiofiles>=23.2.0
httpx>=0.25.0
opencv-python-headless>=4.8.0
numpy>=1.24.0

• Confidence: 95% confidence
• Finding: opencv-python-headless processes complex binary media formats, so unpinned installs materially increase risk from parser vulnerabilities and incompatible releases. In an image/video-processing skill, this is more security-relevant than a typical utility package.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

aiofiles>=23.2.0
httpx>=0.25.0
opencv-python-headless>=4.8.0
numpy>=1.24.0

• Confidence: 90% confidence
• Finding: NumPy is foundational and widely depended on; leaving it unpinned reduces build reproducibility and can unexpectedly pull in problematic releases. While not always directly exposed, in image-processing pipelines it often handles untrusted decoded data and should be tightly managed.

VirusTotal

52/52 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.