Security audit
Security checks for vulnerabilities and agentic risk
This image-segmentation skill does what it claims, but it can automatically install mutable remote code and download large unverified model files during use.
Install only if you are comfortable with the skill changing the Python environment and downloading large model files from the network. Prefer preparing dependencies yourself from pinned, trusted versions and using a local checkpoint whose source you trust before running it.
scripts/segment.py:39Runtime Retrieval and Execution of an Unpinned Remote Dependency
scripts/segment.py:24Downloaded Model Checkpoints Are Loaded Without Integrity Verification
The documentation instructs users to install code directly from a GitHub repository using pip install git+https://..., which pulls and executes unpinned remote package content at install time. Combined with the stated automatic installation behavior, this introduces supply-chain risk: a compromised upstream repo, dependency, or transient branch state could result in arbitrary code execution in the agent environment.
��一个 PNG） python3 scripts/segment.py photo.jpg ./elements/ --all
python3 scripts/segment.py photo.jpg ./elements/ --all --grid 32
python3 scripts/segment.py photo.jpg output.png --checkpoint /path/to/sam_vit_h_4b8939.pth
## 依赖安装
`segment_anything` 首次运行时自动安装，也可手动安装：
```bash
pip install git+https://github.com/facebookresearch/segment-anything.git
pip install pillow numpy torch torchvision
~/.cache/sam/| 模型 | 大小 | 速度 | 质量 |
|---|---|---|---|
vit_b | ~375 MB | 最快 | 良好 |
vit_l | ~1.25 GB | 中等 | 较好 |
vit_h | ~2.5 GB | 较慢 | 最佳 |
有 GPU 时自动使用 CUDA 加速。
Automatically installing a package directly from a remote Git repository at runtime is disproportionate to the advertised image-segmentation task and materially expands the trust boundary. It enables execution of unreviewed third-party code on the user's system without meaningful disclosure or consent.
The script invokes a shell command to install and execute code from a remote GitHub repository at runtime. This creates a software supply-chain risk because unpinned remote code is fetched and installed without integrity verification, user approval, or isolation, allowing arbitrary code execution if the source or network path is compromised.
from segment_anything import SamPredictor, sam_model_registry
except ImportError:
print("正在安装 segment_anything...")
os.system("pip install git+https://github.com/facebookresearch/segment-anything.git -q")
from segment_anything import SamPredictor, sam_model_registry
import torch
The YARA pattern is correctly triggered because the script bootstraps remote code installation from GitHub and then imports it for execution in the same runtime flow. In the context of an agent skill, this is especially dangerous because a seemingly simple local image tool gains the ability to fetch and run arbitrary external code on demand.
print(f"\r {min(b*bs,t)*100//t}%", end="", flush=True) if t > 0 else None)
print()
return path
def _load_sam(model_type, checkpoint):
"""加载 SAM 模型，首次运行时自动安装 segment_anything。"""
try:
from segment_anything import SamPredictor, sam_model_registry
except ImportError:
print("正在安装 segment_anything...")
os.system("pip install git+https://github.com/facebookresearch/segment-anything.git -q")
from segment_anything import SamPredictor, sam_model_registry
import torch
ckpt = ensure_checkpoint(model_type, checkpoint)
sam = sam_model_registry[model_type](checkpoint=ckpt)
device = "cuda" if torch.cuda.is_available() else "cpu"
sam.to(device)
print(f"模型已加载至 {device}")
return SamPredictor(sam)
def segment(image_path, output_path, checkpoint=None, model_type="vit_b", points=None):
"""单目标分割：使用一个或多个提示点提取前景主体。"""
The skill clearly documents shell execution (python3 scripts/segment.py) and network activity through automatic model/download installation, but it declares no tool scope or permissions. This creates an authorization and transparency gap: an agent may invoke shell and network-capable behavior without an explicit policy boundary, increasing the risk of unintended downloads, installs, or file writes during use.
The natural-language instructions and usage guidance are presented only in Chinese, which effectively forces a specific language for users. The file does not offer an alternative language option or explain that the skill is intentionally limited to a Chinese-speaking audience.
The script silently performs network access to download very large model checkpoints when they are missing. While expected for ML tooling, undisclosed automatic downloads can surprise users, bypass offline expectations, and expose them to integrity and availability risks if the remote host is tampered with or unavailable.
The script automatically downloads large model files from the network without prominently disclosing that behavior in the CLI interface. In a local image-processing skill, hidden network activity increases operational and supply-chain risk, especially where users expect purely offline processing.
The script auto-installs software via a shell command after only printing a status message, with no confirmation or safe mode. This normalizes unexpected environmental modification and can lead to arbitrary code execution or system compromise through dependency hijacking or a compromised upstream repository.
Manifest 将技能定位为“去除图像背景，将前景主体提取为透明 PNG”，重点是单个前景主体的背景去除。这里的 segment_all 明确执行全元素分割，并把多个独立对象分别保存为单独 PNG，这超出了“提取前景主体”这一较窄描述范围。
This markdown file describes that omitting --checkpoint causes an automatic download, but it does not present this as a user warning about network activity and local disk impact. Because the skill downloads a large external artifact and stores it under the user's home cache, a clearer warning about network use and filesystem changes would improve user disclosure.
User-facing docstrings, status messages, and CLI help are written exclusively in Chinese, which imposes a language choice on users without opt-in. The policy allows locale constraints when explicitly justified, but this file does not document such a justification or provide alternatives.