Watermark Remover

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:24 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed local PDF watermark-removal helper with some implementation and dependency-safety caveats, but no evidence of hidden, deceptive, persistent, or exfiltrating behavior.

Install only if you are comfortable with a Chinese-language PDF utility that may install unpinned Python libraries after confirmation and may write extracted preview images from your PDFs to disk. Use it on copies of documents, choose a fresh output path in a private directory, and avoid running it with elevated privileges or in shared writable folders.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/check_env.py:32

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/remove_watermark.py:77

Finding

Output File Overwrite Through Symbolic-Link Following

Content

View full analysis

_no_watermark`. An attacker with write access to the output directory can pre-create that predictable path as a symbolic link to another file writable by the Skill's process. There is also a time-of-check/time-of-use concern if validation is added separately from opening the file. Secure creation must therefore use atomic operating-system primitives rather than only calling `os.path.islink()` before `open()`. ### Attack Path 1. The attacker identifies the input PDF path and predicts the default output filename, or learns the explicitly selected output path. 2. The attacker has permission to create directory entries in the output directory. 3. Before watermark removal starts, the attacker creates a symbolic link at the output path pointing to a file writable by the agent. 4. The Skill calls `open(output_path, "wb")`. 5. The operating system follows the symbolic link and truncates the target file. 6. `writer.write(f)` replaces the target's contents with generated PDF data. ### Impact Assessment Exploitation permits corruption or replacement of files writable by the account running the Skill. The precise scope is limited by that account's filesystem permissions. If the process runs with elevated privileges, the overwrite scope may include sensitive configuration or application files. Under ordinary user privileges, l ...[truncated 163 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明的核心能力是“去除 PDF 文件中的水印”，但提供的代码文件名和实现内容均为“detect_watermark”，其主要行为是检测 PDF 内可能的水印对象，并生成检测结果 JSON；对于大图像对象还会提取并保存预览图片。这与“去除水印”的主要目的存在实质性偏差。虽然描述中提到流程里包含“水印检测”，但该代码块只覆盖检测阶段，没有任何修改 PDF、删除对象、重写页面内容或输出去水印 PDF 的逻辑，因此不能视为对声明目的的准确实现。此外，代码通过命令行仅接受一个 PDF 路径，未体现批量处理能力；也没有实现环境检查、库安装确认或去除确认等流程控制。综上，描述与代码实际行为明显不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

代码与“去除 PDF 水印”的大方向基本相关，但声明明显高于实际实现。脚本只接受单个 PDF 路径，没有多文件批量处理逻辑；也没有任何交互式或流程化的环境检查、安装确认、检测确认、去除确认步骤。其去水印方法仅限于删除 /Pattern 资源并替换部分内容流命令，属于较特定的技术处理，不是广义、稳健的 PDF 水印去除能力。因此描述未准确反映代码的真实范围与流程，属于描述与行为不一致。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language content is entirely in Chinese and does not state that language selection is optional or user-driven. Under the policy, forcing a specific language without opt-in can be a locale-policy violation unless the constraint is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are broader than the skill's stated PDF-only scope, so the agent may activate this skill for generic 'remove watermark from file' requests involving unsupported file types. In practice, this can cause the system to run environment checks or file-processing scripts against unintended inputs, increasing the risk of destructive modification attempts, failed processing, or confusion around what files are safe to handle.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code includes the primary natural-language instructions and usage text entirely in Chinese, which effectively forces a specific language for users without any opt-in or alternative. The policy explicitly allows locale constraints only when documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check_env.py (reported line 26)May include surrounding context.

python

"""检查库是否安装"""
    try:
        if lib_name == 'pypdf':
            __import__('pypdf')
        elif lib_name == 'PyMuPDF':
            __import__('fitz')
        elif lib_name == 'pdfplumber':

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check_env.py (reported line 28)May include surrounding context.

python

if lib_name == 'pypdf':
            __import__('pypdf')
        elif lib_name == 'PyMuPDF':
            __import__('fitz')
        elif lib_name == 'pdfplumber':
            __import__('pdfplumber')
        return {'installed': True}

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check_env.py (reported line 30)May include surrounding context.

python

elif lib_name == 'PyMuPDF':
            __import__('fitz')
        elif lib_name == 'pdfplumber':
            __import__('pdfplumber')
        return {'installed': True}
    except ImportError:
        return {'installed': False}

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language strings in the module docstring present the skill exclusively in Chinese, including its description and usage text. Under the policy rule, language constraints should not be forced without user opt-in or clear justification that the tool is intended for a specific locale.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The detection routine does more than inspect the PDF: it extracts embedded image objects and writes them to disk as preview files. This creates unintended data exfiltration and artifact-creation risk because PDFs may contain sensitive embedded images, and users invoking a detection step may not expect file export side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Exporting PDF-embedded images to the filesystem is not clearly necessary for watermark detection and expands the skill's behavior beyond its stated purpose. In a security-sensitive or privacy-sensitive environment, this can leak document contents, leave sensitive files on disk, and surprise downstream automation that assumed analysis-only behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language strings and documentation that require Chinese for usage and output messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script silently writes preview image files without any explicit warning or confirmation, which is a transparency and safety issue. While not inherently code-execution dangerous, hidden filesystem side effects can cause privacy leaks, overwrite concerns, and policy violations in environments that expect non-mutating inspection tools.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.