ClawHub
Back to skill

Security audit

Gemini Watermark Remover

Security checks across malware telemetry and agentic risk

Overview

This skill appears to work as advertised, but its advertised purpose is to strip visible AI provenance watermarks before possible sharing or publishing.

Review carefully before installing. Use only on images you are authorized to edit, and do not use it to hide AI origin, bypass platform rules, or misrepresent generated media. Run it in a virtual environment, keep originals, and preserve appropriate AI-origin disclosure when sharing edited images.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The README explicitly promotes removing visible Gemini watermarks and focuses on effective, lossless removal while providing only a narrow 'personal learning and research' disclaimer. That omission is risky because watermark removal can facilitate provenance stripping, misuse of AI-generated media, and bypass of attribution or platform integrity signals, increasing legal, ethical, and content-authenticity harms.

Vague Triggers

Medium
Confidence
98% confidence
Finding
This skill is explicitly designed to remove a visible AI watermark from generated images, and the description/usage instructions encourage general-purpose removal for publishing or sharing without any limiting conditions. That materially facilitates evasion of provenance and attribution signals, enabling deceptive redistribution of AI-generated content and undermining platform or provider safeguards.

Natural-Language Policy Violations

High
Confidence
99% confidence
Finding
The script’s stated purpose is to remove Gemini-generated image watermarks, which are origin/disclosure markings intended to signal provenance. Building and distributing tooling specifically to defeat such markings enables deceptive reuse and laundering of AI-generated content, making the behavior itself the security/policy issue rather than a coding bug.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.