Security audit

Gemini Image Gen + Watermark Removal

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about generating Gemini images, but it also removes watermarks, installs an unpinned executable, and includes an optional hard-coded Feishu sharing path.

Review before installing. Only use this skill if you are comfortable with an agent operating your logged-in Gemini session, downloading generated images, running an unpinned third-party watermark-removal binary, and potentially sharing images externally. Do not use the Feishu example as written; require an explicit recipient and confirmation before any upload.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:79
Finding: Unpinned Third-Party Executable Installation
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: SKILL.md:88
Finding: Execution of an Unverified Binary from a Predictable Hidden Path
Content: View full analysis
-o <输出图片> ``` ### Technical Analysis The fallback procedure trusts a pre-existing executable located under a predictable user-controlled hidden directory. The Skill does not validate the file's cryptographic hash, signature, ownership, permissions, provenance, or canonical path before recommending its execution. The subsequent command also invokes `gwt` by name. If command resolution depends on the process environment, a different executable earlier in `PATH` could be selected instead of the intended tool. Either condition permits local tool substitution while preserving a legitimate-looking invocation. ### Attack Path 1. An attacker with the ability to write to the user's home directory, Skill directories, extracted archives, or command search path places a malicious executable at the documented fallback path or names it `gwt`. 2. Installation through the preferred method fails, or the agent uses the documented fallback. 3. The Skill invokes the substituted executable to remove a watermark. 4. The malicious program executes with the invoking user's permissions and can perform actions unrelated to image processing. This path requires prior write access to a relevant user-controlled location or another mechanism capable of influencing executable resolution. ### Impact Assessment Exploitation can result in arbitrary code execution with the privileges of the user running the Skill. The substituted binary may access input and output images, user-readable files, environment variables, local configuration, and network resources available to that account. No evidence shows that this procedure directly grants root privileges or bypasses o ...[truncated 129 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:97
Finding: Hard-Coded External Recipient in Optional Image-Transmission Workflow
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This workflow chains together authenticated browser automation, image download, watermark removal, and optional third-party forwarding, creating a clear end-to-end content manipulation and distribution pipeline. In context, the combination is more dangerous than the individual steps because it enables rapid alteration of generated media and subsequent dissemination from a user-authenticated environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs users to remove Gemini watermarks from generated images without any warning about legal, policy, provenance, or integrity implications. Watermark removal is a high-risk content-manipulation capability because it can facilitate misrepresentation of source, bypass platform safeguards, or violate terms of service and downstream trust requirements.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The optional Feishu upload capability is outside the core purpose of Gemini image generation and watermark removal, and it introduces an additional outbound data-transfer path. Because it can transmit locally stored images to a third-party service using a hardcoded user identifier, it expands the skill’s reach and increases the risk of unintended disclosure or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The optional Feishu step sends a local image to an external service without any notice about privacy, consent, data handling, or recipient verification. In the context of a browser-driven workflow operating on files downloaded from a logged-in account, this creates a meaningful exfiltration risk if sensitive or proprietary images are forwarded without adequate safeguards.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructions and description are presented entirely in Chinese, which effectively imposes a language choice on users without an opt-in or stated regional justification. The policy requires avoiding forced language or locale constraints unless user choice or a clear justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.