ClawHub
Back to skill

Security audit

remove-bg

Security checks for vulnerabilities and agentic risk

Overview

This image background-removal skill mostly does what it says, but it also automatically opens the output file and uses a risky Windows shell call that is not clearly disclosed.

Review before installing. The skill appears intended for local image conversion and does not show network access or persistence, but the helper should be changed so opening the output image is an explicit option and the Windows shell=True call is removed. Use only trusted input and output paths until then.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
remove_bg.py:34
Finding

Windows Shell Command Injection Through Attacker-Controlled Output Path

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The natural-language content describing the skill, usage, examples, and implementation is presented only in Chinese. Under the stated policy, forcing a specific language without user opt-in or a documented regional justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module documentation describes only background removal and saving a PNG, but the code also launches the generated file in the system viewer. This hidden side effect undermines user trust and makes the script more dangerous because users are not informed that it will execute external viewer commands.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Executing system viewer commands is not required to remove an image background and save output. Adding external program launch capability increases attack surface and can be abused in environments where scripts are expected to perform only local file transformation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script forces automatic opening of the generated image without asking the user. In a skill or automation context, unexpected application launches are particularly risky because they can trigger external handlers, disrupt workflows, and violate least-surprise expectations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

On Windows, the script invokes a shell-backed command to open the output file automatically. Although the argument is derived from the output path, using shell=True introduces unnecessary command-execution surface and the auto-launch behavior is unrelated to the documented core function of background removal.

Content

Scanner excerpt · remove_bg.py (reported line 35)May include surrounding context.

python
try:
        import subprocess, sys
        if sys.platform.startswith('win'):
            subprocess.run(['start', str(out_path)], shell=True, check=False)
        elif sys.platform.startswith('darwin'):
            subprocess.run(['open', str(out_path)], check=False)
        else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
83% confidence
Finding

The macOS open command launches an external application based on the generated file without user consent. This is less severe than shell-based execution, but it still causes unexpected execution of external programs and expands the script's behavior beyond simple image processing.

Content

Scanner excerpt · remove_bg.py (reported line 37)May include surrounding context.

python
if sys.platform.startswith('win'):
            subprocess.run(['start', str(out_path)], shell=True, check=False)
        elif sys.platform.startswith('darwin'):
            subprocess.run(['open', str(out_path)], check=False)
        else:
            subprocess.run(['xdg-open', str(out_path)], check=False)
    except Exception as e:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
83% confidence
Finding

The xdg-open call triggers the desktop's default handler for the saved file, causing external program execution without opt-in. While commonly used for convenience, it is unnecessary for the stated purpose and may trigger risky handler behavior on the host system.

Content

Scanner excerpt · remove_bg.py (reported line 39)May include surrounding context.

python
elif sys.platform.startswith('darwin'):
            subprocess.run(['open', str(out_path)], check=False)
        else:
            subprocess.run(['xdg-open', str(out_path)], check=False)
    except Exception as e:
        print('Failed to open image:', e)

Static analysis

No suspicious patterns detected.