ClawHub
Back to skill

Security audit

Watermark Remover

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward watermark-removal wrapper with disclosed local image processing, but users should verify the external package and model source before installing.

Install only if you trust the external watermark-remover package and any model it downloads. Run preview mode or test on copies first, especially for directories, and only remove watermarks from images you have the right to modify.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill exposes shell execution behavior through documented Python CLI commands and package installation steps, but it declares no permissions or trust boundary information. That mismatch can cause an agent or user to invoke local commands, install packages, or run scripts without informed consent, increasing the risk of unintended code execution and supply-chain exposure.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger phrases are broad enough to match common image-editing requests like 'clean image', which may activate the skill when the user did not specifically request watermark removal. In this context, accidental invocation is risky because the skill modifies files and may download model assets, potentially causing unwanted content alteration or policy-sensitive watermark removal.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The description does not warn users that the skill alters image content and may auto-download the LaMa model on first run. Missing this disclosure undermines informed consent and can lead to unexpected file modification, network access, and resource usage in environments where such actions are restricted or sensitive.

Unpinned Dependencies

Low
Category
Supply Chain
Content
opencv-python>=4.8
numpy>=1.24
Pillow>=10.0
iopaint>=1.5
Confidence
95% confidence
Finding
The dependency is specified with only a minimum version, which allows future, unreviewed releases to be installed. This creates supply-chain and reproducibility risk because a later compromised or incompatible version of opencv-python could be pulled into the environment without validation.

Unpinned Dependencies

Low
Category
Supply Chain
Content
opencv-python>=4.8
numpy>=1.24
Pillow>=10.0
iopaint>=1.5
Confidence
95% confidence
Finding
The numpy requirement is unpinned, so dependency resolution may install any newer release that satisfies the lower bound. That weakens build integrity and can introduce vulnerable or malicious upstream versions unexpectedly.

Unpinned Dependencies

Low
Category
Supply Chain
Content
opencv-python>=4.8
numpy>=1.24
Pillow>=10.0
iopaint>=1.5
Confidence
95% confidence
Finding
Using Pillow with a >= specifier permits uncontrolled upgrades to newer releases, reducing reproducibility and increasing supply-chain exposure. For an image-processing skill that handles untrusted files, unexpected dependency changes can materially affect security posture.

Unpinned Dependencies

Low
Category
Supply Chain
Content
opencv-python>=4.8
numpy>=1.24
Pillow>=10.0
iopaint>=1.5
Confidence
96% confidence
Finding
The iopaint package is unpinned, so the environment may fetch arbitrary later versions with behavior or dependency changes not reviewed by the skill author. Because this package is central to AI-based image inpainting and may pull substantial transitive dependencies, the supply-chain risk is elevated.

Static analysis

No suspicious patterns detected.