Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently performs cloud-based image cleanup, with disclosed uploads, provider selection, and costs.
Images and prompts leave your computer for processing. Select your intended provider explicitly and preview with --dry-run, since existing credentials otherwise determine routing. Check costs, use a separate output path, and review provider privacy terms before submitting confidential images. The installed external CLI was not audited.
The explicit flat-lay task serves a materially different purpose from removing unwanted image content. Dry-run and help commands do not themselves establish external generation, billing, or image modification. This assessment is limited to the supplied snippet; the underlying script's implementation is not shown.
Referenced artifact was not completely inspected
node scripts/gen.mjs --task remove-watermark \
Referenced artifact was not completely inspected
| 统一入口的全部选项 | `node scripts/gen.mjs --help` |
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
把图上的**水印、文字、角标、优惠券条、装饰边框**去掉，并把被挡住的画面补回来。
最常见的用途是**给别的技能准备干净输入**：带文字的图丢给 [fission-pattern](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/fission-pattern/skill.md) 或 [clothing-grass-planting](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/clothing-grass-planting/skill.md)，那些文字会被复制到每一张衍生图里。
---
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
把图上的**水印、文字、角标、优惠券条、装饰边框**去掉，并把被挡住的画面补回来。
最常见的用途是**给别的技能准备干净输入**：带文字的图丢给 [fission-pattern](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/fission-pattern/skill.md) 或 [clothing-grass-planting](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/clothing-grass-planting/skill.md)，那些文字会被复制到每一张衍生图里。
---
The workflow directs the agent to submit source images to hosted processing services without explicitly explaining that image contents leave the local environment. Users requesting image cleanup could therefore expose confidential product photographs or personal information without informed approval.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The manifest describes removing watermarks, text, and logos from images. However, L108–L110 accept any configured task rather than restricting execution to watermark removal, L115–L122 explicitly accommodate video models, and L146–L147 enable video and text request modes. These additional generation capabilities are not justified by the stated image-cleanup purpose.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
model: () => env.GEN_MODEL_OPENAI || 'gpt-image-1',
describe(req) {
const ep = req.images?.length ? 'images/edits' : 'images/generations'
return `POST https://api.openai.com/v1/${ep} model=${openai.model()} size=${mapSize(req.size)} n=${req.batch}`
},
async run(req) {
const key = env.OPENAI_API_KEY
This call uploads source-image bytes and the editing prompt to OpenAI, and the router can select OpenAI automatically merely because its credential exists. Without a provider-approval gate, confidential images can leave the environment through an implicitly selected destination; the concern is missing consent, not malicious exfiltration.
: await readFile(p)
fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p))
}
r = await fetch('https://api.openai.com/v1/images/edits', {
method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
})
} else {
This URL is part of the actual image-upload call, not just documentation, and the adapter sends local image contents to it. Automatic credential-based provider selection without an approval gate creates a privacy exposure for sensitive inputs; this is the same underlying issue as the other finding on this call.
: await readFile(p)
fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p))
}
r = await fetch('https://api.openai.com/v1/images/edits', {
method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
})
} else {
The manifest describes removing watermarks, text, or logos from an existing image. When no input images are supplied, the OpenAI provider instead calls images/generations with an arbitrary prompt, implementing standalone image synthesis rather than image cleanup. This is a separate capability, unlike the image-editing API calls that directly support the stated purpose.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
})
} else {
r = await fetch('https://api.openai.com/v1/images/generations', {
method: 'POST',
headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
body: JSON.stringify({
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
})
} else {
r = await fetch('https://api.openai.com/v1/images/generations', {
method: 'POST',
headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
body: JSON.stringify({
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
model: (req) =>
env.GEN_MODEL_REPLICATE ||
(req?.images?.length ? 'black-forest-labs/flux-kontext-pro' : 'black-forest-labs/flux-dev'),
describe(req) { return `POST https://api.replicate.com/v1/models/${replicate.model(req)}/predictions` },
async run(req) {
const input = { prompt: req.prompt, num_outputs: req.batch }
if (req.images?.length) input.input_image = await asDataUri(req.images[0])
This request sends the editing prompt and source-image data or URL to Replicate. Because the router can select this provider from ambient credentials without explicit destination approval, sensitive images may be disclosed to an unexpected processor.
const input = { prompt: req.prompt, num_outputs: req.batch }
if (req.images?.length) input.input_image = await asDataUri(req.images[0])
const j = await postJson(
`https://api.replicate.com/v1/models/${replicate.model(req)}/predictions`,
{ input },
{ authorization: `Bearer ${env.REPLICATE_API_TOKEN}`, prefer: 'wait' },
req.timeoutMs,