Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
AI Remove Watermark
v0.1.7Remove watermarks from images through the Airemovewatermark API. Use when an agent needs to remove a watermark from a local image file or remote image URL, p...
⭐ 1· 102·0 current·0 all-time
by@isees
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name, description, SKILL.md, manifest, and the included Node script all describe the same capability: uploading an image (local or remote) to airemovewatermark, polling task status, and optionally downloading results. The required binary (node) and single required credential (API_KEY) are proportional to this purpose.
Instruction Scope
SKILL.md and the script instruct the agent to read local image files (to upload them), call the remote API, poll async tasks, and optionally download results into a local artifact directory. This behavior is expected for watermark removal, but users should be explicitly aware that local files are uploaded to a remote service and that the script writes downloaded outputs to .openclaw-artifacts/remove-watermark/.
Install Mechanism
No install spec is present (instruction-only with a bundled script), so nothing is downloaded during install beyond the included files. This is low-risk compared to arbitrary remote installs.
Credentials
The manifest and SKILL.md require a single API_KEY (primary credential), which is appropriate. The script also accepts fallback environment variable names (REMOVE_WATERMARK_API_KEY and REMOVE_WATERMARK_BASE_URL) that are not declared in the manifest or SKILL.md; this is a minor inconsistency but not an obvious security problem. No unrelated credentials are requested.
Persistence & Privilege
The skill does not request 'always: true' or other elevated platform privileges, and it only writes artifacts under its own .openclaw-artifacts/remove-watermark/ directory. It does not modify other skills or global agent config.
Assessment
This skill appears to do what it claims: it uploads local images to the airemovewatermark service and returns or downloads cleaned images. Before installing or using it, consider the following:
- You must provide an API key (API_KEY). Keep that key secret; the script will send it to the airemovewatermark API. Treat the key like any other service credential.
- Local image files are read and uploaded to the remote service as part of processing. Only use this skill with images you own or are authorized to edit.
- Downloaded results (when --download true) are saved under .openclaw-artifacts/remove-watermark/ in the current working directory.
- The script accepts alternate environment variable names (REMOVE_WATERMARK_API_KEY and REMOVE_WATERMARK_BASE_URL) not declared in the manifest or SKILL.md; this is a minor mismatch you should be aware of but not necessarily malicious.
- There is no install-time download of remote code; the included Node script performs network calls during runtime to the declared base URL (https://airemovewatermark.net) and its asset host. If you need greater assurance, review the full script (scripts/remove_watermark.mjs) to confirm behavior for uploads, polling, and downloads before providing credentials.scripts/remove_watermark.mjs:54
Environment variable access combined with network send.
scripts/remove_watermark.mjs:2
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97d67b8gkjzxhq1bdjjsesss5838yzh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsnode
EnvAPI_KEY
Primary envAPI_KEY