Watermark Remover

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:56 AM UTC
• Version: 0.1.0

Overview

This skill does what it says, but it relies on an unverified external watermark-removal program and gives broad, under-scoped instructions for a legally sensitive image-editing action.

Review this carefully before installing. Only use it on images you own or are authorized to modify, prefer preview mode first, keep backups, and do not install the external `watermark-remover` package unless you can verify its publisher, source repository, version, and dependency lockfile.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/main.py:13

Finding

Unverified and Unpinned External Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:13-15, 54-61; related installation guidance in SKILL.md:14-20, README.md:18-24, and unpinned dependencies in requirements.txt:1-4
Vulnerability Type: Supply-chain exposure through an unverified package, placeholder source repository, open-ended dependency constraints, and PATH-based executable resolution
Risk Level: High

Complete Code Snippets

scripts/main.py:13-15:

python

def check_installation():
    """Check if watermark-remover is installed"""
    return shutil.which("watermark-remover") is not None

scripts/main.py:54-61:

python

# Check if installed
if not check_installation():
    print_installation_help()
    sys.exit(1)

# Run the CLI
try:
    result = subprocess.run(
        ["watermark-remover"] + sys.argv[1:],
        check=False
    )

SKILL.md:14-20:

bash

# Install from PyPI (when published)
pip install watermark-remover

# Or install from source
git clone https://github.com/yourusername/watermark-remover.git
cd watermark-remover
pip install -e .

README.md:18-24:

bash

# Option A: Install from PyPI (when published)
pip install watermark-remover

# Option B: Install from source
git clone https://github.com/yourusername/watermark-remover.git
cd watermark-remover
pip install -e .

requirements.txt:1-4:

text

opencv-python>=4.8
numpy>=1.24
Pillow>=10.0
iopaint>=1.5

Technical Analysis

The skill does not contain the advertised watermark-removal implementation. Instead, it resolves an executable named watermark-remover from the process environment's PATH and forwards all command-line arguments to that executable.

The installation documentation compounds this trust-boundary issue by recommending a package described as not yet published and a source repository under the placeholder account yourusername. The dependenc ...[truncated 2096 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the placeholder repository URL with a verified repository controlled by an identified and trusted publisher.
2. Do not recommend installation from PyPI until package ownership and provenance have been verified.
3. Pin the external package and every direct dependency to reviewed versions. Use a lock file and require cryptographic hashes for downloaded distributions.
4. Pin source installations to an immutable commit digest rather than a mutable branch or tag.
5. Run the dependency in a dedicated virtual environment and invoke it through an absolute, validated path or a verified Python module instead of resolving an arbitrary executable from PATH.
6. Before execution, verify the executable's canonical path, expected version, owner, and integrity.
7. Audit and lock transitive dependencies, including model-loading components.
8. If the LaMa model is downloaded automatically, document the exact trusted source and verify the model artifact with a pinned checksum or signature.
9. Apply runtime isolation and least privilege: restrict filesystem access to required input and output locations, remove unnecessary credentials from the environment, and limit network access.
10. Prefer including a reviewable implementation in the skill or vendoring a cryptographically verified release so that actual behavior can be audited with the wrapper.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes automatic watermark removal on single images and whole directories without warning that files may be altered, outputs may be legally or ethically problematic, or backups should be made first. In this skill context, that omission is more serious because watermark removal is a high-risk capability that can facilitate copyright circumvention and accidental bulk modification of user data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes shell commands for installation and execution but does not declare any tool scope or permissions boundary. In an agent environment, this creates an authorization gap where the skill may be run with broader shell access than intended, increasing the chance of arbitrary command execution or unsafe filesystem/network side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases include generic terms like "clean image," which can match benign image-editing requests unrelated to watermark removal. Overbroad invocation can cause the agent to select this skill unexpectedly, leading to unauthorized alteration of copyrighted or evidentiary content and exposing users to policy and legal risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is explicitly designed to remove watermarks, but the description provides no warning that doing so may be unauthorized, infringing, or unlawful. Because watermark removal can facilitate copyright evasion, provenance stripping, and misuse of protected media, the lack of a warning or policy guard materially increases the risk of harmful deployment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 60)May include surrounding context.

python

# Run the CLI
    try:
        result = subprocess.run(
            ["watermark-remover"] + sys.argv[1:],
            check=False
        )

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README says the LaMa model auto-downloads on first run but does not prominently warn users that execution may initiate network access and fetch external artifacts. This can surprise users in restricted or sensitive environments and may violate expectations around offline operation, dependency provenance, or change-control.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with only a lower bound, so builds may resolve to different versions over time, including releases with newly introduced bugs or supply-chain issues. In a security-sensitive image-processing skill, this weakens reproducibility and makes it difficult to verify whether a deployed version is patched against known OpenCV vulnerabilities.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

opencv-python>=4.8
numpy>=1.24
Pillow>=10.0
iopaint>=1.5

Unverifiable Dependency: opencv-python has 16 known advisory(ies) (CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

OpenCV has known advisories, and because the manifest does not pin a version, there is no reliable way to determine whether the installed release includes fixes. In a package that handles user-provided images, unverifiable exposure to image-parser flaws increases risk even if the manifest's minimum version might be safe in some environments.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Using an unpinned numpy version allows package resolution to drift between environments and over time, which can silently introduce vulnerable or incompatible releases. This undermines reproducible builds and makes incident response and patch verification harder.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

opencv-python>=4.8
numpy>=1.24
Pillow>=10.0
iopaint>=1.5

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

NumPy has published advisories, but the current requirement does not identify the exact installed version, so its security posture cannot be verified. This creates avoidable uncertainty in the dependency chain and complicates assurance that deployed environments are patched.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Pillow processes untrusted image data, and leaving it unpinned increases the chance of deploying a version affected by parser bugs, resource-exhaustion flaws, or code-execution issues. Because this skill's purpose is image manipulation on user-supplied files, dependency drift here is more dangerous than in a non-file-processing tool.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

opencv-python>=4.8
numpy>=1.24
Pillow>=10.0
iopaint>=1.5

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Pillow has a history of vulnerabilities in image decoding and processing, and this skill explicitly works on user-supplied images. Without a pinned version, the deployment may unknowingly include a vulnerable release, making this unverifiable dependency notably riskier in this context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The unpinned iopaint dependency creates supply-chain and reproducibility risk because the exact code installed is not fixed or auditable from the manifest alone. Since this package likely performs core AI inpainting functionality, unexpected upstream changes could affect security, behavior, or model-handling logic.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

opencv-python>=4.8
numpy>=1.24
Pillow>=10.0
iopaint>=1.5

Static analysis

No suspicious patterns detected.