Image Editing

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:45 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward image-editing guide, but users should know some examples upload selected images to third-party services.

Before using cloud examples, confirm that the image, mask, prompt, and metadata may be sent to the named provider. Prefer the documented local tools for private, regulated, customer, family, or confidential images, and install dependencies in an isolated environment with reviewed versions when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: background-removal.md:10
• Finding: Cloud Image Uploads Lack an Explicit User Consent Boundary<![CDATA[ ## Vulnerability Details **File Location**: `background-removal.md:10-26`, `background-removal.md:37-52`, `tools.md:11-18`, `tools.md:30-80`, `inpainting.md:14-27`, `outpainting.md:31-36`, `restoration.md:54-74`, `restoration.md:127-130`, `upscaling.md:43-65` **Vulnerability Type**: Unconsented Third-Party Data Disclosure **Risk Level**: Medium ### Relevant Code `background-removal.md:10-15`: ```bash curl -X POST "https://api.remove.bg/v1.0/removebg" \ -H "X-Api-Key: YOUR_API_KEY" \ -F "image_file=@photo.jpg" \ -F "size=auto" \ -o "result.png" ``` `background-removal.md:20-26`: ```python response = requests.post( "https://api.remove.bg/v1.0/removebg", files={"image_file": open("photo.jpg", "rb")}, data={"size": "auto"}, headers={"X-Api-Key": "YOUR_API_KEY"} ) with open("result.png", "wb") as f: f.write(response.content) ``` `background-removal.md:37-40`: ```python response = requests.post( "https://clipdrop-api.co/remove-background/v1", files={"image_file": open("photo.jpg", "rb")}, headers={"x-api-key": "YOUR_API_KEY"} ) ``` `background-removal.md:49-52`: ```python response = requests.post( "https://sdk.photoroom.com/v1/segment", files={"image_file": open("photo.jpg", "rb")}, headers={"x-api-key": "YOUR_API_KEY"} ) ``` `tools.md:30-39`: ```python response = requests.post( "https://api.stability.ai/v1/generation/stable-diffusion-xl-1024-v1-0/image-to-image", headers={"Authorization": f"Bearer {API_KEY}"}, files={"init_image": open("image.png", "rb")}, data={ "text_prompts[0][text]": "description", "init_image_mode": "IMAGE_STRENGTH", "image_strength": 0.35 } ) ``` `tools.md:48-70`: ```python response = requests.post( "https://clipdrop-api.co/remove-background/v1", headers={"x-api-key": API_KEY}, files={"image_file": open("photo.jpg", "rb")} ) response = requests.post( "https://clipdrop-api.co/cleanup/v1", headers={"x-api-key ...[truncated 3097 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before every external upload. The prompt should name the provider and identify whether the image, mask, prompt, and metadata will be transmitted. 2. Default to a local processing option when one can satisfy the request, particularly for faces, documents, medical images, credentials, or other sensitive content. 3. Ask the user to choose between local and cloud processing instead of silently selecting a cloud service. 4. Strip EXIF and other unnecessary metadata before transmission, while preserving the untouched original locally. 5. Limit file access to the exact paths selected by the user and validate that symbolic links do not redirect processing to unintended files. 6. Document provider retention, training, jurisdiction, and deletion considerations or direct the user to the applicable provider policy. 7. Avoid logging image contents, prompts, masks, authorization headers, or full API responses. 8. Read API keys from protected environment variables or a secrets manager, and never place real keys directly in commands, source files, or generated reports. 9. Check response status and content type before writing the response to disk so that provider errors are not mistaken for valid images. ]]>

T08 · Insecure Dependencies

Warning

• Location: tools.md:89
• Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `background-removal.md:59`, `inpainting.md:63`, `restoration.md:10`, `upscaling.md:11`, `tools.md:89-112` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Relevant Code `background-removal.md:59`: ```bash pip install rembg ``` `inpainting.md:63`: ```bash pip install iopaint ``` `restoration.md:10`: ```bash pip install gfpgan ``` `upscaling.md:11`: ```bash pip install realesrgan ``` `tools.md:89-112`: ```bash pip install iopaint iopaint start --model lama --port 8080 ``` ```bash pip install rembg[gpu] # or rembg for CPU rembg i input.jpg output.png ``` ```bash pip install realesrgan realesrgan-ncnn-vulkan -i input.jpg -o output.png ``` ```bash pip install gfpgan python inference_gfpgan.py -i inputs/ -o results/ ``` ### Technical Analysis The installation commands do not pin reviewed versions, verify package hashes, use a lockfile, or require an isolated environment. Package resolution is therefore mutable: the installed package and its transitive dependencies can change after the Skill has been audited. Python package installation can execute package build and installation logic with the privileges of the invoking user. Subsequent imports and command execution also run package-controlled code. A compromised upstream release, dependency, configured package index, or transitive component could consequently execute arbitrary code. The audit did not find evidence that the named packages are intentionally malicious or typosquatted. The finding concerns unsafe dependency acquisition practices and the resulting supply-chain attack surface. ### Attack Path 1. An agent follows the documented `pip install` command. 2. pip queries the configured package index and resolves the latest compatible package plus transitive dependencies. 3. A compromised or unexpectedly replaced distribution is downloaded because no approved version or cryptographic hash is enforced. 4. Package- ...[truncated 1085 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed version and maintain a lockfile containing all transitive dependencies. 2. Require cryptographic hashes, for example with a hash-locked requirements file and `pip install --require-hashes`. 3. Install packages inside a dedicated virtual environment or disposable container rather than the agent's shared environment. 4. Use an explicitly approved package index and prevent fallback to untrusted or user-controlled indexes. 5. Review dependency provenance, release history, maintainers, known vulnerabilities, and transitive dependencies before updates. 6. Separate installation from normal Skill execution. Installation should require explicit approval rather than occurring automatically in response to an image-edit request. 7. Run image-processing tools as a non-administrative account with minimal filesystem and network access. 8. Pin model identifiers and verify downloaded model files with trusted checksums where practical. 9. Perform upgrades through a controlled review process instead of resolving the newest available package during each installation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (22)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill includes examples that send local image files to third-party background-removal services, but it does not warn users that image contents are uploaded off-device and may contain sensitive or regulated data. In a general image-editing skill, this omission can lead to unintentional disclosure of personal, confidential, or customer imagery.

External Transmission

Medium

• Category: Data Exfiltration

Content

### remove.bg (API)

```bash
curl -X POST "https://api.remove.bg/v1.0/removebg" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -F "image_file=@photo.jpg" \
  -F "size=auto" \

• Confidence: 86% confidence
• Finding: The curl example explicitly posts `photo.jpg` to remove.bg, which is an external transfer of local content. While normal for a SaaS integration example, presenting it without privacy or compliance caveats can enable inadvertent leakage of sensitive image data.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
import requests

response = requests.post(
    "https://api.remove.bg/v1.0/removebg",
    files={"image_file": open("photo.jpg", "rb")},
    data={"size": "auto"},

• Confidence: 90% confidence
• Finding: This example performs an HTTP POST to a third-party API and uploads a local image file, creating an external data transmission path. The code itself is expected for the feature, but without surrounding privacy guidance or sensitivity checks it can cause users to exfiltrate images to an external processor unintentionally.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

response = requests.post(
    "https://api.remove.bg/v1.0/removebg",
    files={"image_file": open("photo.jpg", "rb")},
    data={"size": "auto"},
    headers={"X-Api-Key": "YOUR_API_KEY"}

• Confidence: 84% confidence
• Finding: This line is another occurrence of the same remove.bg upload path within the Python example and represents a real external transmission of image data. The surrounding skill context reduces suspicion of malicious intent but not the privacy risk, because users may run the snippet on sensitive files.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
import requests

response = requests.post(
    "https://clipdrop-api.co/remove-background/v1",
    files={"image_file": open("photo.jpg", "rb")},
    headers={"x-api-key": "YOUR_API_KEY"}

• Confidence: 89% confidence
• Finding: This request sends `photo.jpg` to ClipDrop over the network, so using it on private images exposes data to an external service. In the context of an image-editing skill, that behavior is functional rather than malicious, but the lack of disclosure makes the transmission security-relevant.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Photoroom API

```python
response = requests.post(
    "https://sdk.photoroom.com/v1/segment",
    files={"image_file": open("photo.jpg", "rb")},
    headers={"x-api-key": "YOUR_API_KEY"}

• Confidence: 88% confidence
• Finding: This example transmits a local image to Photoroom's API, which is an external processing action with privacy implications. Because the document presents multiple cloud options without cautionary text, users may not recognize that image data leaves their environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example sends local image and mask files to the OpenAI Images Edit API, which transfers user-provided content to an external third-party service. Without an explicit warning about data egress, users may unintentionally upload sensitive images or redacted regions they assumed would stay local, creating privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill provides example code that sends image content to OpenAI's DALL-E API but does not warn users that their images and prompts are transmitted to a third-party external service. This can expose sensitive, personal, or proprietary image data if users assume processing is local, especially in an image-editing context where uploaded files may contain private content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This example sends a local image file to Replicate, a third-party remote service, but does not disclose that image contents leave the local environment. In an image-editing skill, users may reasonably test with personal portraits or sensitive photos, so the omission can cause unintentional privacy and data-handling exposure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The old photo restoration snippet uploads a local photo to Replicate without clearly warning about external transmission. Old photos often contain identifiable family members or sensitive historical/personal content, so the lack of disclosure increases the chance of accidental privacy violations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This colorization example uses Replicate to process a local image file but does not tell the user that the file is sent externally. Because black-and-white photos are frequently personal or archival images, this can expose sensitive visual data to a third party without informed user awareness.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document provides multiple examples that upload local image files to third-party cloud APIs but does not explicitly warn that user-provided images are transmitted off-device. In an image-editing skill, users may reasonably assume local processing unless clearly told otherwise, creating privacy and data-handling risk for sensitive photos, masks, or metadata.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
import requests

response = requests.post(
    "https://api.stability.ai/v1/generation/stable-diffusion-xl-1024-v1-0/image-to-image",
    headers={"Authorization": f"Bearer {API_KEY}"},
    files={"init_image": open("image.png", "rb")},

• Confidence: 88% confidence
• Finding: This example sends a local image file to Stability AI over the network for processing. While expected for a cloud API example, it still creates a real external data-transmission path for potentially sensitive images without any surrounding privacy warning or consent guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

response = requests.post(
    "https://api.stability.ai/v1/generation/stable-diffusion-xl-1024-v1-0/image-to-image",
    headers={"Authorization": f"Bearer {API_KEY}"},
    files={"init_image": open("image.png", "rb")},
    data={

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

# Background removal
response = requests.post(
    "https://clipdrop-api.co/remove-background/v1",
    headers={"x-api-key": API_KEY},
    files={"image_file": open("photo.jpg", "rb")}

• Confidence: 90% confidence
• Finding: The ClipDrop background-removal example uploads a local photo to an external API. In this skill context, the transmission is functional rather than malicious, but it still exposes user images to a third party and may surprise users if not disclosed.

External Transmission

Medium

• Category: Data Exfiltration

Content

)

# Cleanup (remove objects)
response = requests.post(
    "https://clipdrop-api.co/cleanup/v1",
    headers={"x-api-key": API_KEY},
    files={

• Confidence: 91% confidence
• Finding: This cleanup example uploads both the source image and a mask file to ClipDrop, increasing the amount of user data disclosed to the external service. Masks can reveal edited regions or user intent, so the privacy impact can exceed a simple single-image upload.

External Transmission

Medium

• Category: Data Exfiltration

Content

)

# Relight
response = requests.post(
    "https://clipdrop-api.co/relight/v1",
    headers={"x-api-key": API_KEY},
    files={"image_file": open("photo.jpg", "rb")},

• Confidence: 89% confidence
• Finding: The relight example transmits a local photo to ClipDrop's external API for processing. The behavior matches the skill's purpose, but absent disclosure it remains a privacy-relevant data exfiltration path from the user's environment to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

### remove.bg

```python
response = requests.post(
    "https://api.remove.bg/v1.0/removebg",
    headers={"X-Api-Key": API_KEY},
    files={"image_file": open("photo.jpg", "rb")},

• Confidence: 90% confidence
• Finding: The remove.bg sample uploads a local image file to an external background-removal service. This is not inherently malicious, but it is a genuine data-transfer risk because users may submit personal, proprietary, or regulated imagery without realizing it is sent off-device.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
response = requests.post(
    "https://api.remove.bg/v1.0/removebg",
    headers={"X-Api-Key": API_KEY},
    files={"image_file": open("photo.jpg", "rb")},
    data={"size": "auto"}

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Magnific AI example explicitly uploads a local file (`photo.jpg`) to a third-party cloud API, but the documentation does not warn users that image contents will leave the local environment. This creates a real privacy and data-handling risk, especially if users process sensitive, personal, or proprietary images under the assumption that the workflow is local-only.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Magnific AI

```bash
curl -X POST "https://api.magnific.ai/v1/upscale" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "image=@photo.jpg" \
  -F "scale=2"

• Confidence: 88% confidence
• Finding: The presence of a third-party API endpoint is not inherently dangerous, but in this context it corresponds to an example that transmits user-supplied image data externally. Without disclosure or safeguards, this can expose sensitive image contents and metadata to an outside provider.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Replicate example opens a local image file and submits it to a hosted external model endpoint, but the skill provides no user-facing disclosure that the image is transmitted off-device. In an image-editing skill, users may reasonably expect some tools to be local, so omission of this distinction can lead to accidental disclosure of confidential or personal imagery.

Static analysis

No suspicious patterns detected.