ClawHub
Back to skill

Security audit

Image Watermark Remover

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its watermark-removal purpose, but its helper script can send the user's API key and image data to an arbitrary API host if redirected by an option.

Review this before installing. Use it only with images you are authorized to edit and only with public, non-sensitive image URLs. Do not pass --base-url unless you fully control and trust the endpoint, because that option can disclose the Nowatermark API key and submitted URL to another server.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/remove_watermark.py:24
Finding

Arbitrary API Base URL Allows Credential and Task-Data Disclosure

Content
View full analysis

Vulnerability Details

File Location: scripts/remove_watermark.py, lines 24-32, 52, and 65-66
Vulnerability Type: Unrestricted credential forwarding to a user-controlled endpoint
Risk Level: High

Vulnerable Code

python
def post_json(url: str, api_key: str, payload: dict, timeout: int, user_agent: str) -> dict:
    body = json.dumps(payload).encode("utf-8")
    request = urllib.request.Request(
        url,
        data=body,
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Bearer {api_key}",
            "User-Agent": user_agent,
            "Accept": "application/json, text/plain, */*",
            "Origin": DEFAULT_BASE_URL,
            "Referer": f"{DEFAULT_BASE_URL}/",
        },
        method="POST",
    )
python
parser.add_argument("--base-url", default=DEFAULT_BASE_URL, help="API base URL")
python
submit_url = args.base_url.rstrip("/") + SUBMIT_PATH
status_url = args.base_url.rstrip("/") + STATUS_PATH

Technical Analysis

The script permits callers to override the API origin using --base-url. The supplied value is not restricted by scheme or hostname. Every request to the resulting URL includes the production API key in the Authorization header.

Consequently, a caller can redirect requests to an arbitrary server and receive:

  • The NOWATERMARK_API_KEY bearer credential.
  • The submitted image URL.
  • Existing or newly returned request IDs.
  • Subsequent polling traffic.

This behavior exceeds the minimum privileges required for the declared functionality. The Skill documentation identifies https://nowatermark.info as the intended external service; sending its credential to an arbitrary origin is unnecessary. Allowing a plaintext http:// base URL would also expose the credential and payload to network interception.

Attack Path

  1. An attacker influences the command invocati ...[truncated 1276 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --base-url option from production use and always send authenticated requests to the fixed https://nowatermark.info origin.
  2. If endpoint overrides are required for development, place them behind an explicit test-only mode that does not use production credentials.
  3. Enforce an exact allowlist of approved HTTPS origins. Validate the parsed scheme, normalized hostname, and port rather than relying on string prefixes.
  4. Reject plaintext HTTP and URLs containing embedded credentials.
  5. Ensure redirects cannot forward the Authorization header to a different origin. Disable redirects or validate every redirect destination before following it.
  6. Use separate, limited-scope development credentials for testing custom endpoints.
  7. Document the only approved data recipient and fail closed when origin validation fails.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/remove_watermark.py:73
Finding

Documented Public Image URL Security Controls Are Not Enforced

Content
View full analysis

Vulnerability Details

File Location: scripts/remove_watermark.py, lines 73-81; documented requirement in SKILL.md, lines 46-48
Vulnerability Type: Missing input and outbound-data validation
Risk Level: Medium

Vulnerable Code

python
if args.request_id:
    request_id = args.request_id
else:
    if not args.file_url:
        fail("--file-url is required unless --request-id is provided.")
    submit = post_json(
        submit_url,
        api_key,
        {"file_url": args.file_url},
        args.timeout,
        args.user_agent,
    )

The corresponding declared security requirement is:

markdown
3. Require a direct public image URL; reject local paths, page URLs, and expiring signed URLs.

Technical Analysis

The implementation verifies only that --file-url has a nonempty value. It does not enforce the documented requirements that the input be:

  • An HTTP or HTTPS URL.
  • A direct image URL.
  • Publicly accessible.
  • An approved image format.
  • Free from embedded credentials.
  • Non-expiring and not a signed URL.

The unvalidated value is immediately transmitted to the remote processing service. The security policy therefore depends on callers following prose instructions rather than on an enforceable script invariant.

This creates an outbound disclosure risk when a user accidentally or maliciously supplies a private, credential-bearing, or signed URL. It may also cause the external API to attempt retrieval of an unintended destination. Whether that becomes server-side request forgery depends on the remote service's own validation and network access and cannot be established from this project alone.

Attack Path

  1. An attacker or mistaken user supplies a private, signed, credential-bearing, malformed, or non-image value through --file-url.
  2. The script checks only that the argument is present.
  3. The value is placed unchanged into the JSON b ...[truncated 864 chars]
Remediation
View remediation

Remediation Suggestions

  1. Parse --file-url with a standards-compliant URL parser before making any request.
  2. Allow only approved schemes, preferably https.
  3. Reject URLs containing usernames, passwords, malformed hosts, or unsupported ports.
  4. Resolve hostnames and reject loopback, link-local, private, multicast, reserved, and other non-public address ranges. Revalidate after DNS resolution and redirects where retrieval is under local control.
  5. Validate supported image formats using reliable metadata where possible. Treat filename extensions as advisory rather than sufficient proof of content type.
  6. Detect likely signed or credential-bearing query parameters and require explicit informed confirmation before transmitting them. Because signed-URL detection cannot be exhaustive, clearly warn users whenever a URL contains sensitive query data.
  7. Clearly display the external recipient and request confirmation before transmitting potentially sensitive URLs.
  8. Retain equivalent server-side URL validation because client-side checks alone cannot protect the remote fetcher from redirect- or DNS-based bypasses.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill requires access to environment secrets and external network calls, but it does not declare an explicit tool scope such as allowed-tools or permissions. This creates an authorization gap: an agent runtime may grant broader capabilities than intended, making it easier for the skill to access secrets or make outbound requests without clear policy enforcement or user visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The reference clearly instructs users to send file_url values and authenticated job queries to nowatermark.info, but it does not warn that image URLs, request identifiers, and related metadata are disclosed to a third-party service. This can cause unintentional data sharing, especially if users supply sensitive or access-controlled image URLs under the assumption processing is local or first-party.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The documented curl example performs an authenticated POST to an external service and transmits a user-supplied image URL, which is a real external data transfer. In this skill context, that behavior is expected functionality rather than covert exfiltration, but it is still security-relevant because users may provide sensitive URLs or credentials-backed resources without realizing they are being shared with a third party.

Content

Scanner excerpt · references/api.md (reported line 37)May include surrounding context.

Manual call:

bash
curl -X POST "https://nowatermark.info/api/image/remove-watermark" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $NOWATERMARK_API_KEY" \
  --data-raw '{"file_url":"https://example.com/input.png"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script sends both a user-supplied image URL and a bearer API key to a third-party service, but it does not clearly warn the operator that image content and associated metadata will leave their environment. In a privacy-sensitive or enterprise setting, this can cause unintended disclosure of proprietary or personal images, and the skill’s purpose—watermark removal—makes the external transfer more sensitive because it may be used on copyrighted or restricted material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The setup and usage instructions tell users to provide a public image URL to a third-party watermark-removal API, but they do not clearly warn that the referenced image will be transmitted to an external service. This creates a privacy and data-handling risk because users may unknowingly submit sensitive, copyrighted, or internal images to a non-local processor.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.