A Python CLI skill for Cutout.Pro visual APIs — background removal, face cutout, and photo enhancement. Supports file upload & image URL input.

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:42 AM UTC
• Version: 1.0.0

Overview

This image-processing skill mostly does what it says, but it under-discloses third-party handling of sensitive images and contains misleading API-key storage guidance.

Review carefully before installing. Use only images and URLs you are authorized to send to Cutout.Pro, avoid sensitive portraits, identity documents, regulated data, private signed URLs, or internal-only assets unless your organization approves that processing, and store CUTOUT_API_KEY outside the repository or add a real .gitignore before creating a .env file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup-guide.md:84

Finding

API Key May Be Accidentally Committed Due to Missing Git Exclusion

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/requirements.txt:1

Finding

Unpinned Dependency Without Artifact Integrity Verification

Content

View full analysis

=2.28.0 ``` The documented installation command in `SKILL.md:60` is: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis The dependency specification sets only a lower bound for `requests`. It permits the package resolver to select any later release available at installation time. No lock file, exact version, transitive-dependency constraints, or cryptographic artifact hashes are supplied. Consequently, the installed dependency set is not reproducible and may differ from the dependency code considered during this audit. If a future permitted release or one of its resolved transitive dependencies is compromised, replaced, or introduces a security regression, users can install that code through the documented command without any project-level integrity check. The package name `requests` is legitimate, and the audited files contain no evidence of typosquatting or a deliberately malicious package. This finding concerns the avoidable supply-chain exposure created by unconstrained future versions and absent artifact verification. ### Attack Path 1. A future version of `requests`, or a transitive package selected by the resolver, becomes compromised or otherwise unsafe. 2. The compromised version still satisfies the `>=2.28.0` constraint. 3. A user follows the documented `pip install -r scripts/requirements.txt` command. 4. Pip resolves and downloads the unsafe artifact because no exact version or expected hash prevents its selection. 5. Malicious or vulnerable dependency code executes during an applicable installation or import/runtime path when `scripts/cutout.py` imports `requests`. 6. The dependency code runs with the permissio ...[truncated 597 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 56)May include surrounding context.

python

def _parse_env_file(env_path: Path) -> dict[str, str]:
    """Parse a .env file and return a key=value dictionary."""
    result: dict[str, str] = {}
    if not env_path.exists():
        return result

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 77)May include surrounding context.

python

def _parse_env_file(env_path: Path) -> dict[str, str]:
    """Parse a .env file and return a key=value dictionary."""
    result: dict[str, str] = {}
    if not env_path.exists():
        return result

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cutout.py (reported line 194)May include surrounding context.

python

def _parse_env_file(env_path: Path) -> dict[str, str]:
    """Parse a .env file and return a key=value dictionary."""
    result: dict[str, str] = {}
    if not env_path.exists():
        return result

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 81)May include surrounding context.

python

key = os.environ.get("CUTOUT_API_KEY")
    if key:
        return key
    env_data = _parse_env_file(ROOT_DIR / ".env")
    return env_data.get("CUTOUT_API_KEY")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes uploading local images or supplying remote image URLs to a third-party service, but it does not clearly warn users that image contents and possibly metadata will be transmitted off-host to Cutout.Pro. For a visual-processing skill, that omission can lead users to send sensitive photos, identity documents, or internal images without informed consent, creating privacy and compliance risk rather than a memory-safety bug.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill performs sensitive actions implied by its documentation and referenced scripts—reading environment variables for an API key, reading and writing local files, and making outbound network requests—yet it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens transparency and policy enforcement, increasing the chance that an agent could invoke broader capabilities than a user expects when processing local images and external URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill encourages uploading local image files and submitting image URLs to Cutout.Pro, but it does not prominently warn users that image content will be transmitted to a third-party external service for processing. This creates a privacy and data-handling risk, especially for personal photos, biometric face images, or proprietary images that users may assume are processed locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation instructs users to upload image files or submit image URLs to a third-party service without any privacy or data-handling warning. Because user images may contain personal, sensitive, or regulated data, omitting notice of external transmission can cause unintentional disclosure and non-compliant use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The faceAnalysis feature is described as returning facial landmarks and face bounding data, but the documentation does not warn that this may involve biometric-like facial information being transmitted to and generated by an external service. In environments handling employee, customer, or identity images, this omission raises privacy, consent, and regulatory risk beyond ordinary image processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 288)May include surrounding context.

python

import requests

response = requests.post(
    'https://www.cutout.pro/api/v1/matting?mattingType=6',
    files={'file': open('/path/to/photo.jpg', 'rb')},
    headers={'APIKEY': 'your_api_key_here'},

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 315)May include surrounding context.

python

import requests

response = requests.post(
    'https://www.cutout.pro/api/v1/matting?mattingType=6',
    files={'file': open('/path/to/photo.jpg', 'rb')},
    headers={'APIKEY': 'your_api_key_here'},

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This example transmits a portrait image to an external service and requests faceAnalysis, which returns facial landmark data. In context, this is more sensitive than ordinary outbound traffic because it processes face imagery and derives biometric-like metadata, yet the example provides no warning, consent guidance, or data-sensitivity caveat.

Content

Scanner excerpt · references/api-reference.md (reported line 301)May include surrounding context.

python

import requests

response = requests.post(
    'https://www.cutout.pro/api/v1/matting2?mattingType=3&faceAnalysis=true',
    files={'file': open('/path/to/portrait.jpg', 'rb')},
    headers={'APIKEY': 'your_api_key_here'},

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill uploads local image contents to a third-party API, but the CLI does not provide an explicit privacy or data-transfer warning at the point of use. This can lead users to unintentionally send sensitive images off-system, which is a real privacy/security issue even though the network behavior is functionally expected for this integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Although the document notes that API calls consume credits, it does not present this as a user-facing warning before usage examples or invocation steps, so a user may trigger paid operations without informed consent. In agent settings, this can lead to unexpected account consumption or small financial loss through repeated or automated requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

User-supplied image URLs are forwarded to an external API without an explicit notice that the URL itself will be shared with a third party. While less sensitive than raw file upload in many cases, URLs can still expose internal locations, signed links, or private resources if users are not clearly informed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as requests>=2.28.0, which allows installation of any newer version without ensuring reproducibility or constraining to a reviewed release. This increases supply-chain risk and makes it difficult to verify whether deployments will avoid vulnerable or breaking versions over time.

Content

Scanner excerpt · scripts/requirements.txt (reported line 4)May include surrounding context.

text

# Cutout.Pro Visual API Skill - Dependencies
# Install: pip install -r requirements.txt

requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The manifest references requests without pinning to a specific version, while multiple known advisories exist for that package. Because the exact installed version is undefined, consumers may resolve to a vulnerable release, making the dependency posture unverifiable and potentially exposing the skill to known issues such as credential leakage or request-handling flaws.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.