去豆包水印

• Outcome: Review
• Latest audit: Jul 12, 2026 · 5:09 AM UTC
• Version: 1.0.1

Overview

This skill is a transparent local image tool, but it is built to remove AI-provider watermarks in bulk, which users should review carefully before installing.

Install only if you have the right to remove the marks from the images you process. Use an isolated environment, prefer pinned dependency versions, avoid processing untrusted images, and write to a fresh output directory unless you intend to overwrite prior outputs with --force.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence
• Finding: The skill instructs the agent to inspect local image files and directories, which is a file-read capability, but no permissions are declared. Undeclared data access weakens transparency and consent controls, and could lead to the skill being invoked on user files without a clear permission boundary.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger text is overly broad because it activates not only for Doubao watermark removal but also for general batch watermark removal requests. That increases the chance the skill is selected in contexts involving unauthorized alteration of copyrighted, licensed, or provenance-marked images.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The documented use of --force encourages overwriting outputs but does not warn about irreversible replacement of existing files in the output path. In batch operations, this can cause silent data loss or destruction of prior edited results, especially when users reuse directories.

Ssd 4

Medium

• Confidence: 94% confidence
• Finding: The skill provides concrete, repeatable instructions for removing AI-generated watermarks and corner markers, including preset coordinates for specific image sizes and batch-processing guidance. In context, this directly facilitates stripping provenance or attribution indicators at scale, which can enable misuse, deceptive redistribution, and policy evasion.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

opencv-python-headless
numpy

• Confidence: 93% confidence
• Finding: The dependency is unpinned, so installs may resolve to different versions over time, causing unpredictable behavior and potentially pulling in a newly introduced vulnerable or malicious release. In a security-sensitive image-processing skill that handles untrusted image files, lack of version pinning weakens reproducibility and patch governance.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

opencv-python-headless
numpy

• Confidence: 93% confidence
• Finding: The numpy dependency is unpinned, which makes builds non-reproducible and can expose deployments to supply-chain risk or unexpected introduction of insecure versions. Because this skill processes external image data in batches, dependency drift can materially affect security posture and reliability.

Known Vulnerable Dependency: opencv-python-headless — 10 advisory(ies): CVE-2019-14493 (NULL Pointer Dereference in OpenCV.); CVE-2019-9423 (Out-of-bounds Write in OpenCV); CVE-2019-14491 (Out-of-bounds Read in OpenCV) +7 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The package name is associated with multiple historical OpenCV advisories, and without a version pin there is no assurance that installation will avoid vulnerable releases. Since this skill is intended to parse and manipulate user-supplied images, any memory-safety flaw in image decoding or processing could be reachable and lead to crashes or, in worst cases, code execution.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The dependency name maps to numerous published advisories, and the absence of a pinned safe version means vulnerable numpy builds may be installed. While some numpy CVEs are environment-specific or disputed, this skill's batch processing of external files still increases concern because native-code numeric libraries can be part of exploit chains causing denial of service or memory corruption.

Static analysis

No suspicious patterns detected.