rembg: remove-image-background

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:16 AM UTC
• Version: 0.0.1

Overview

This appears to be a legitimate background-removal skill, but unsafe script behavior and persistent environment changes make it require careful review before installation.

Install only if you trust the publisher and are comfortable with a home-directory virtualenv, model downloads, and persistent PATH edits. Avoid processing filenames or output paths from untrusted sources until the dynamic `python -c` path handling is fixed, upgrade the rembg dependency, and prefer an explicit setup step over automatic installation during image processing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/remove_bg.py:140

Finding

Arbitrary Python Code Execution Through Unsafely Interpolated File Paths

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: setup/install.py:62

Finding

PowerShell Command Injection Through Unescaped PATH Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (34)

Known Vulnerable Dependency: rembg==2.0.72 — 3 advisory(ies): CVE-2026-40086 (Rembg has a Path Traversal via Custom Model Loading); GHSA-55v6-g8pm-pw4c (rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak defa); CVE-2026-40086 (Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal v)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is pinned to rembg[cpu,cli]==2.0.72, and the provided advisories indicate this version is affected by known vulnerabilities, including path traversal in custom model loading and SSRF-related issues in the server component. Even though this skill is for background removal, the package extras include CLI functionality and the vulnerable version is explicitly installed, so using it in setup increases real supply-chain and runtime risk if untrusted inputs or server features are exposed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs users to run local Python setup and processing scripts that create a virtual environment under the user's home directory, install dependencies, download models, and perform file operations, yet it declares no explicit tool scope or permissions. This creates a trust and review gap: an agent or user may execute shell, filesystem, and environment-affecting actions without clear upfront authorization boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill metadata and main documentation are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative language option. The policy explicitly calls for flagging language or locale constraints when the skill does not offer user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is written only in Chinese ("使用 rembg AI 模型去除图片背景") with no indication that the skill is region-specific or that users can choose another language. This can violate language/locale policy when a skill implicitly enforces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script's stated purpose is batch background removal, but it auto-installs and executes a setup script as part of normal operation. In this context, that behavior is more dangerous because it violates user expectations and causes additional code execution not strictly necessary for processing images.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 74% confidence

Finding

This code automatically executes setup/install.py when the expected virtual environment is missing. In a skill context, that means a routine image-processing command can unexpectedly run additional installation logic from the repository, increasing the trust boundary and enabling arbitrary code execution if the project files are tampered with or unreviewed.

Content

Scanner excerpt · scripts/batch_remove_bg.py (reported line 63)May include surrounding context.

python

print("=" * 50)
        
        install_script = os.path.join(PROJECT_ROOT, "setup", "install.py")
        result = subprocess.run([sys.executable, install_script], capture_output=True, text=True)
        
        if result.returncode != 0:
            print(f"✗ 环境初始化失败 (Environment initialization failed): {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 74% confidence

Finding

As with the earlier installer path, the script automatically runs setup/install.py if rembg import fails. This expands a simple batch-processing operation into arbitrary local code execution from the repository, which is risky in an agent skill because users may not expect setup code to run during normal processing.

Content

Scanner excerpt · scripts/batch_remove_bg.py (reported line 82)May include surrounding context.

python

print("=" * 50)
            
            install_script = os.path.join(PROJECT_ROOT, "setup", "install.py")
            result = subprocess.run([sys.executable, install_script], capture_output=True, text=True)
            
            if result.returncode != 0:
                print(f"✗ 环境初始化失败 (Environment initialization failed): {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The script builds a Python code string for python -c by interpolating input_file and output_file directly into quoted source code. A filename containing quotes or Python syntax can break out of the string literal and execute arbitrary Python when the batch job processes attacker-controlled files or paths.

Content

Scanner excerpt · scripts/batch_remove_bg.py (reported line 120)May include surrounding context.

python

"""
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.returncode == 0

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script is described as a single-image background remover, but it also bootstraps and installs an execution environment. This mismatch increases the risk of users running code that performs broader system changes than expected, which is a security-relevant transparency issue.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/batch_remove_bg.py (reported line 29)May include surrounding context.

python

for cmd in python_cmds:
        try:
            result = subprocess.run([cmd, "--version"], 
                                  capture_output=True, text=True, timeout=5)
            if result.returncode == 0:
                system_python = cmd

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/remove_bg.py (reported line 29)May include surrounding context.

python

for cmd in python_cmds:
        try:
            result = subprocess.run([cmd, "--version"], 
                                  capture_output=True, text=True, timeout=5)
            if result.returncode == 0:
                system_python = cmd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/batch_remove_bg.py (reported line 44)May include surrounding context.

python

print()
        print("请先安装 Python (Please install Python first):")
        print("  - macOS: brew install python3")
        print("  - Linux: sudo apt install python3 / sudo yum install python3")
        print("  - Windows: https://www.python.org/downloads/")
        print()
        sys.exit(1)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/remove_bg.py (reported line 44)May include surrounding context.

python

print()
        print("请先安装 Python (Please install Python first):")
        print("  - macOS: brew install python3")
        print("  - Linux: sudo apt install python3 / sudo yum install python3")
        print("  - Windows: https://www.python.org/downloads/")
        print()
        sys.exit(1)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill has capabilities beyond its core function, including installer execution and subprocess orchestration. While not inherently malicious, these extra capabilities enlarge the attack surface and create an unexpected code-execution path in a tool that users may assume only manipulates images.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script automatically initializes components under the user's home directory and runs subprocesses without an explicit warning or confirmation before making those changes. This is risky because it can surprise users and provides a covert execution/modification path under a benign-seeming command.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 82% confidence

Finding

This script automatically executes setup/install.py on first run without a clear prior opt-in, causing code execution and environment modification outside the stated core task of background removal. If the package contents are tampered with, this becomes a straightforward execution path for arbitrary code.

Content

Scanner excerpt · scripts/remove_bg.py (reported line 63)May include surrounding context.

python

print("=" * 50)
        
        install_script = os.path.join(PROJECT_ROOT, "setup", "install.py")
        result = subprocess.run([sys.executable, install_script], capture_output=True, text=True)
        
        if result.returncode != 0:
            print(f"✗ 环境初始化失败 (Environment initialization failed): {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/batch_remove_bg.py (reported line 74)May include surrounding context.

python

else:
        # 检查 rembg 是否安装
        try:
            subprocess.run([venv_python, "-c", "import rembg"], 
                        capture_output=True, check=True)
        except:
            print("=" * 50)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/remove_bg.py (reported line 74)May include surrounding context.

python

else:
        # 检查 rembg 是否安装
        try:
            subprocess.run([venv_python, "-c", "import rembg"], 
                        capture_output=True, check=True)
        except:
            print("=" * 50)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 82% confidence

Finding

This is a second code path that automatically runs setup/install.py when rembg is missing, again executing additional code and modifying the user's home directory without explicit consent at the point of action. The skill context makes this more concerning because a seemingly simple image-processing command silently performs installation behavior.

Content

Scanner excerpt · scripts/remove_bg.py (reported line 82)May include surrounding context.

python

print("=" * 50)
            
            install_script = os.path.join(PROJECT_ROOT, "setup", "install.py")
            result = subprocess.run([sys.executable, install_script], capture_output=True, text=True)
            
            if result.returncode != 0:
                print(f"✗ 环境初始化失败 (Environment initialization failed): {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The script builds a Python code string with user-controlled input_file and output_file interpolated directly into a python -c command. A filename containing quotes or Python syntax can break out of the string literal and achieve arbitrary code execution in the spawned interpreter, making this more dangerous than a normal subprocess invocation.

Content

Scanner excerpt · scripts/remove_bg.py (reported line 153)May include surrounding context.

python

"""
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"✗ 处理失败 (Processing failed): {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · setup/check_env.py (reported line 34)May include surrounding context.

python

venv_python = os.path.join(VENV_DIR, "bin", "python")
    
    try:
        result = subprocess.run(
            [venv_python, "-c", "import rembg; print(rembg.__version__)"],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · setup/check_env.py (reported line 54)May include surrounding context.

python

# 尝试检查 u2net 模型
    try:
        result = subprocess.run(
            [venv_python, "-c", 
             "from rembg import new_session; s = new_session('u2net'); print('OK')"],
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 87% confidence

Finding

The PowerShell command string includes data derived from the current PATH environment variable and is passed to powershell -Command. If PATH contains quotes or PowerShell metacharacters, this can break out of the intended string and cause unintended PowerShell command execution during installation; because this script modifies persistent user PATH, the installer context makes this more sensitive than ordinary local tooling.

Content

Scanner excerpt · setup/install.py (reported line 68)May include surrounding context.

python

# 使用 PowerShell 设置环境变量
                ps_cmd = f'[Environment]::SetEnvironmentVariable("PATH", "{new_path}", "User")'
                result = subprocess.run(
                    ["powershell", "-Command", ps_cmd],
                    capture_output=True,
                    text=True

Tainted flow: 'ps_cmd' from os.environ.get (line 67, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 92% confidence

Finding

This is a real tainted-data flow: os.environ['PATH'] is incorporated into ps_cmd and then executed by PowerShell. An attacker who can influence PATH in the process environment before the installer runs could inject additional PowerShell syntax, leading to arbitrary command execution in the user's context.

Content

Scanner excerpt · setup/install.py (reported line 68)May include surrounding context.

python

# 使用 PowerShell 设置环境变量
                ps_cmd = f'[Environment]::SetEnvironmentVariable("PATH", "{new_path}", "User")'
                result = subprocess.run(
                    ["powershell", "-Command", ps_cmd],
                    capture_output=True,
                    text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · setup/install.py (reported line 137)May include surrounding context.

python

try:
        # Windows 下使用 --copies 避免符号链接问题
        if system == "Windows":
            subprocess.run([sys.executable, "-m", "venv", "--copies", VENV_DIR], check=True)
        else:
            subprocess.run([sys.executable, "-m", "venv", VENV_DIR], check=True)
        print("✓ 虚拟环境创建成功 (Virtual environment created)")

Static analysis

No suspicious patterns detected.