Security audit
Security checks for vulnerabilities and agentic risk
Review is needed because file-protection promises have gaps and an included sharing helper can expose unrelated local files.
Prefer a corrected release that removes the project scripts and fixes the output-path and deletion safeguards. If proceeding, run only the documented cleaner on copies in a fresh output folder and keep independent backups. Avoid processing untrusted HTML with the sharing helper.
scripts/peninsula_cut_clusters.pyCluster-cut helper overwrites an installed asset pack without an explicit write gate
Matching installed PNGs are overwritten with pixels made transparent, followed by additional small-component removal. This can unintentionally alter live application assets rather than only producing output previews.
The clearest mismatch is the write-safety contract: supplying --ids directly leads to Image.fromarray(...).save(path), with no dry-run mode or explicit confirmation check. Backups are created before modification, but this does not satisfy the promised confirmation requirement. The candidate-removal logic also targets thin peninsula regions rather than only isolated connected fragments; its distance-transform guard explicitly attempts to avoid cutting subject interiors. Comparison images and logs are supporting cleanup features, not independent mismatches. The imported helper's implementation is not supplied, so its additional behavior cannot be assessed.
The core island-removal operation matches part of the description, but the promised safeguards are absent: Image.save overwrites each affected source file during ordinary execution, without confirmation or backup creation. The alpha threshold is used to construct the connected-component mask, not to clear all below-threshold haze. The imported module's additional behavior cannot be assessed from the supplied chunk.
The supplied implementation allows --out to resolve to the input image, overwriting it without the backup used by --apply. This violates the documented non-overwriting behavior and can cause irreversible image loss; --no-backup, in contrast, is explicitly documented as an opt-out.
The code shares the general image-cleanup domain and does create byte-level backups, but it materially contradicts the declared write-safety workflow: matched files are saved in place unconditionally. Its operation is also specialized to four named, coordinate-and-area-matched peninsula targets, rather than implementing the described haze-threshold and isolated-component cleanup. The external helper's implementation is not supplied, so its additional behavior cannot be assessed; the visible unconditional writes alone establish the mismatch.
Preview generation could support a cleanup workflow, so clustering and HTML reporting alone would not establish a mismatch. However, the unconditional shutil.rmtree(CROPDIR) is a destructive operation inconsistent with the declared default dry-run and confirmation/backup safeguards. The supplied chunk also implements cross-frame candidate inspection rather than the advertised removal methods and does not modify source PNG alpha data. Its malformed statistics-file expression prevents the intended reporting workflow from completing, but occurs after the directory deletion. Behavior of the dynamically imported peninsula_trial.py cannot be determined from this chunk.
Although fragment analysis and visual reports could support a cleanup workflow, this chunk primarily ranks animation flicker and does not implement the declared cleanup or confirmed write-back process. More importantly, it unconditionally calls shutil.rmtree on the existing peninsula_flicker directory before generating reports, an undeclared destructive side effect inconsistent with the stated dry-run default. It reads existing backups but does not create backups or request confirmation. The dynamically loaded peninsula_trial.py is not supplied, so any additional behavior from that module cannot be assessed.
The main discrepancy is the removal criterion. Connected components are measured after erosion, so a protrusion belonging to the original subject can become a separate candidate and subsequently be erased. This extends beyond cleaning small isolated alpha islands and can remove legitimate attached details. Conversely, the alpha threshold only creates a detection mask; it does not remove low-alpha haze as declared. Preview generation is a supporting diagnostic feature, and overwriting originals is explicitly gated by --apply --pack and preceded by a byte-level copy.
The supplied HTML helper can read arbitrary local paths referenced in HTML and embed their raw bytes in an output intended for sharing. Although generating previews is not inherently suspicious, this behavior can disclose local secrets and is outside the advertised image-cleanup safeguards.
Review-page generation can support image cleanup, so reporting alone would not establish a mismatch. However, this script unconditionally calls shutil.rmtree on its output directory and regenerates files, contrary to the declared dry-run-first, confirmation-before-writing behavior. The visible code does not remove artifacts from source PNGs or create byte-level backups; backup and cleanup claims embedded in the generated HTML describe prior work, not operations performed here. It also executes an external peninsula_trial.py module whose additional behavior cannot be determined from this chunk.
Report generation and reading alpha masks are consistent with a dry-run cleanup workflow, and this chunk does not modify source PNGs. However, shutil.rmtree(CROPDIR) deletes existing output contents without confirmation, validation, or backup; that destructive behavior is not disclosed by the dry-run description. The analysis also targets attached peninsula-like structures using morphological erosion rather than limiting detection to low-alpha haze and already-isolated regions. The code contains no image-cleaning or confirmed-backup implementation, though their absence alone is not decisive because this is only a supplied code chunk.
Supplying cluster IDs immediately modifies source PNGs without an apply flag or confirmation, contrary to the skill's dry-run-first contract. Strict matching, the solid-region guard, and backups reduce the damage but do not authorize the edits or prevent unintended removal of legitimate artwork.
Running this script immediately edits hardcoded source frames, without obtaining current confirmation or providing a dry-run mode. Exact target matching limits exposure, but it cannot establish that the user authorized these edits; unconditional copying to an existing backup filename can also replace an earlier recovery point.
The script immediately overwrites hardcoded source frames and merely assumes that backups from an earlier operation exist. Its small-component cleanup matches the skill's purpose, but bypassing confirmation and failing to verify or create recovery copies can cause unauthorized, unrecoverable artwork changes.
Without declared permissions the skill's intent is opaque and cannot be validated.
Haze removal happens before component ranking, so a low-alpha subject can be erased despite the unconditional keep-largest promise. The 30% refusal check only measures island removal, and the early return can permit complete haze removal without refusal, creating a data-integrity risk when results are saved.
The --out save path is not checked against the input, so specifying the input filename or its containing directory can overwrite the original. This bypasses both --apply and its automatic backup, despite help text promising that --out does not overwrite the original.
An attacker-controlled HTML src value can use an absolute path or traversal to reference any readable local file. When image decoding fails, the fallback embeds the file's raw bytes as base64, potentially leaking credentials or other sensitive data when the generated HTML is shared; no network request is necessary.
Once the preceding dynamic import succeeds, executing or importing this script recursively deletes the existing hard-coded review directory without confirmation or backup. Deletion occurs before input validation, so later processing failures can leave prior results permanently lost; the project-only label does not make the operation safe.
The unconditional rmtree removes every file in the existing output directory, not merely known generated crops. This is the same destructive operation identified by SDI-1 and can erase manually added content or previous review results without an opportunity to recover.
Morphological erosion can identify thin connected features of legitimate artwork, and the apply path removes all returned candidates rather than restricting removal to isolated components or low-alpha haze. Default previews, staging, and explicit flags for source modification substantially reduce exposure, but the expanded removal scope can still damage artwork when applied.
L107 explicitly announces that dry-run writes no files. However, whenever candidates are found, L150-L151 and L162-L163 create directories and save images regardless of --apply, so the stated no-write guarantee is false.
The analysis script recursively removes its existing report directory before generating replacements, without confirmation or preserving its contents. The fixed report-only destination limits the likely impact, but unrelated files or manually annotated reports stored there would be lost.
The script does not disclose that generating an analysis report first destroys all existing contents of its output directory. This is the same underlying deletion issue as the other finding in this source, with exposure confined to the designated report directory.
Rebuilding the pages recursively deletes the existing crop directory without checking whether it contains only reproducible generated files. Although source PNGs are not modified, prior annotations or unrelated files in that directory can be destroyed without authorization.
The page-rebuild description does not disclose the recursive removal of existing crop-output contents. This duplicates the underlying deletion behavior identified by SDI-1, rather than establishing a separate source-artwork risk.