pet-asset-keying

• Outcome: Pass
• Latest audit: Oct 30, 2026 · 9:53 AM UTC
• Version: 0.1.0

Overview

This skill processes selected images locally, with a working model-free method and some documentation and reliability issues in its alternative tools.

Use line_keying.py for model-free processing. The hybrid alternatives require additional dependencies and model resources, and the temporal helper has a missing module. Keep originals, choose a separate output directory, and inspect results manually because hole counts do not provide an automatic safety stop.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The output goal matches background removal for frame sequences, but the implementation materially contradicts the declared method and dependency constraints. key_sequence() unconditionally calls mask_model() for every frame; mask_model() imports rembg.remove and creates a model session through rembg.new_session(). The --no-vote option disables only temporal voting, not AI segmentation. The code then constructs an eroded/dilated trimap and estimates alpha rather than cutting along the character's existing outline. Local image reads, PNG writes, cropping, and diagnostic reporting are consistent supporting behaviors.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The output purpose broadly matches background removal, but the primary processing method directly contradicts explicit description claims. Every call to key_array invokes _alpha_model, which imports rembg, creates a model session, and performs semantic background removal; there is no model-free path. The traditional branch estimates alpha across an eroded/dilated trimap and narrows it rather than implementing the described outline-cut approach. The code does provide hole statistics, but it does not implement the claimed automatic warning for abnormal hole counts. These are substantive method and resource discrepancies, not merely supporting implementation details.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The cutout goal matches, but the supplied operation directly contradicts the explicitly declared implementation constraints. The PITFALLS.md location could indicate an example of a discouraged technique, especially given the advertised backfires list; however, the supplied chunk contains no such qualification. No unrelated resource access or triggers are shown.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The cutout pipeline requires rembg model inference instead of implementing the declared model-free outline-cut method.

Medium

• Category: Excessive Agency
• Confidence: 100% confidence

Finding

The manifest specifies outline-cut processing and explicitly states that no AI model or rembg is required. However, key_array unconditionally invokes _alpha_model at L124 and intersects its result with traditional matting at L126; _alpha_model imports rembg, creates a model session, and runs inference. There is no model-free execution path in this file.

Content

No source excerpt is available for this finding.

The documented abnormal-hole safety warning is not implemented.

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The module documentation at L25 explicitly promises a warning when the hole count is abnormal. The implementation only calculates hole statistics and prints ordinary counts, with no abnormality check or conditional warning; batch processing likewise only aggregates counts at L232-L235. This presents diagnostic reporting as a safety guardrail that the code does not actually enforce.

Content

No source excerpt is available for this finding.

Sequence keying requires rembg model inference despite the manifest's explicit model-free claim.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The manifest states 'No AI model required (no rembg / no torch / no onnx)', but L085-L090 imports rembg and performs model-based segmentation with alpha matting. This is mandatory for every sequence: L147 unconditionally invokes mask_model for each frame, and --no-vote disables only temporal voting, not model inference.

Content

No source excerpt is available for this finding.