Security audit

AI Remove Watermark

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent watermark-removal skill, but it needs review because it can upload any agent-readable file and an API key to a configurable endpoint without strong validation.

Install only if you trust the Airemovewatermark service and the agents invoking it. Keep API_BASE_URL unset unless you intentionally use a trusted endpoint, provide only image files you are authorized to upload, and avoid letting untrusted prompts choose local file paths or command arguments.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/remove_watermark.mjs:51
Finding: API Credentials and Arbitrary Local Files Can Be Sent to an Untrusted Configurable Endpoint
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
- `scripts/remove_watermark.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
- `scripts/remove_watermark.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
- `scripts/remove_watermark.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
- `scripts/remove_watermark.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
- `scripts/remove_watermark.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
- `scripts/remove_watermark.mjs`

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill requires access to environment variables and makes outbound network requests, but it does not explicitly declare a tool scope such as permissions or allowed-tools. That weakens runtime containment and reviewability, because an agent may invoke this skill with broader capabilities than intended, including access to sensitive API keys and remote data transfer to a third-party service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends either a local image file or a remote image URL to a third-party service, but it does not present a clear runtime warning or require explicit confirmation that user data will leave the local environment. In an agent setting, this can cause unintended disclosure of sensitive images, embedded metadata, or internal URLs, especially when the tool is invoked automatically based on high-level user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest explicitly advertises that completed output may be saved to the local artifact directory, but it does not warn users that the skill performs local file writes or describe the conditions under which files are created. In an agent setting, undisclosed filesystem writes can surprise users, overwrite expected workspace contents, or persist sensitive transformed images locally when the user expected only remote API processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: When --download is enabled, the script creates directories and writes the processed image to a default artifacts path. The help text documents the save location, but the code provides no direct user-facing warning at execution time that a file write will occur.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/remove_watermark.mjs:54