Watermark Remover

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 1.0.0

Overview

The skill openly removes MLS and copyright-style watermarks and runs mutable third-party model code, so it should be reviewed carefully before installation.

Install only if you are comfortable with a tool designed to remove watermark and provenance markings, and use it only on images you own or are expressly authorized to modify. Run it in an isolated environment, pin and review dependencies/models, avoid preserving sensitive EXIF metadata when sharing outputs, and keep backups because output files, masks, and result summaries may be overwritten.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/remove_watermark.py:35

Finding

Mutable Remote Model Code Is Trusted and Executed

Content

View full analysis

Vulnerability Details

File Location: scripts/remove_watermark.py, lines 35-37
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

python

processor = AutoProcessor.from_pretrained(model_id, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    model_id, trust_remote_code=True
).to(device)

Technical Analysis

Both model-loading operations enable trust_remote_code=True. This permits Python implementation files obtained from the remote microsoft/Florence-2-base model repository to execute locally.

The model repository is referenced by name without an immutable revision commit hash. Consequently, the executable code retrieved during a future run may differ from the code available when the Skill was reviewed. Trusting a reputable namespace reduces likelihood but does not eliminate risks from repository compromise, account takeover, upstream changes, or dependency-resolution manipulation.

The downloaded implementation executes in the same process and security context as the Skill. It is therefore not restricted to model inference and can perform any operation available to the invoking user.

Attack Path

1. An attacker compromises the upstream model repository, its publisher account, or the model retrieval path.
2. The attacker modifies the repository's custom Python implementation while preserving the expected model identifier.
3. A user runs the watermark-removal script.
4. from_pretrained() retrieves the modified remote implementation.
5. trust_remote_code=True authorizes Transformers to load and execute that implementation.
6. The payload executes with the invoking user's permissions before or during image processing.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the user running the Skill. The payload could read or modify user-accessible files, inspect process-accessible sec ...[truncated 264 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove trust_remote_code=True when using a Transformers release that supports Florence-2 natively.
2. If custom remote code remains necessary, pin revision to a reviewed immutable commit hash for both loading calls.
3. Download, inspect, and package the required model implementation as a controlled local dependency rather than retrieving mutable code at runtime.
4. Verify downloaded model artifacts against approved cryptographic hashes.
5. Run model loading and inference in a least-privilege container or sandbox with restricted filesystem access and no unnecessary network connectivity.
6. Establish a controlled update process in which new model revisions are reviewed and tested before deployment.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Third-Party Executable Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-13
Additional Execution Location: scripts/remove_watermark.py, lines 173-184
Vulnerability Type: Unpinned executable third-party dependencies
Risk Level: Medium

bash

pip install iopaint transformers torch pillow
# Optional OCR fallback:
pip install paddleocr paddlepaddle

The installed IOPaint package is subsequently executed as follows:

python

cmd = [
    py, "-m", "iopaint", "run",
    f"--model={model}",
    f"--device={device}",
    f"--image={image_path}",
    f"--mask={mask_path}",
    f"--output={out_dir}",
]

result = subprocess.run(cmd, capture_output=True, text=True)

Technical Analysis

The installation instructions do not constrain package versions, lock transitive dependencies, or provide cryptographic hashes. Installation therefore resolves whatever package versions and dependency graph are available from the configured package index at installation time.

Python packages can execute code through build and installation mechanisms. The script also explicitly runs the installed iopaint package as a Python module, giving its runtime code the same permissions as the invoking user. Future package updates, compromised releases, or malicious transitive dependencies could therefore change the Skill's effective executable behavior after review.

The use of subprocess.run() with a list rather than a shell command prevents ordinary shell metacharacter injection through the arguments. The relevant issue is trust in mutable, unpinned package code rather than shell injection.

Attack Path

1. An upstream package account, package release, build artifact, or transitive dependency is compromised.
2. A user follows the documented unpinned pip install commands.
3. The package resolver selects the compromised or unexpectedly modified release.
4. Malicious code executes during package installation or ...[truncated 732 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed lock file containing exact versions for all direct and transitive dependencies.
2. Require cryptographic hashes, for example with pip install --require-hashes -r requirements.txt.
3. Use a dedicated virtual environment or least-privilege container rather than installing into a shared Python environment.
4. Retrieve packages only from an explicitly configured trusted index or internal artifact repository.
5. Scan locked packages and transitive dependencies for known vulnerabilities before release.
6. Review dependency updates through a controlled process instead of automatically resolving the latest versions.
7. Restrict network and filesystem access while running third-party model and inpainting components.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This skill is explicitly designed to remove watermarks, which are commonly ownership, attribution, licensing, or provenance markings. Automating their removal materially enables copyright infringement, circumvention of content protections, and deceptive reuse of media at scale.

Content

No source excerpt is available for this finding.

Ssd 2

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The framing and stated purpose center on removing watermarks from images, which indicates assistance in bypassing ownership/provenance markings rather than a neutral image-processing function. In this skill context, that purpose increases danger because the entire pipeline is optimized for a misuse case with clear abuse potential.

Content

No source excerpt is available for this finding.

Ssd 2

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The detection logic specifically targets MLS, copyright, listing, logo, and related text markers so they can be masked and erased downstream. This domain-tuned selection demonstrates intentional optimization for stripping protected markings from real-estate and copyrighted imagery, increasing the likelihood of harmful misuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises shell execution and file-writing behavior but does not declare any tool scope or permissions boundaries. In an agent environment, this creates unnecessary ambiguity about what the skill may execute or modify, increasing the risk of unintended command execution or filesystem changes beyond what a user expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This skill is specifically designed to remove watermarks from images, which is often legally, ethically, or policy-sensitive and can facilitate circumvention of ownership, attribution, licensing, or MLS compliance controls. The absence of a clear warning or usage restriction makes misuse more likely, and the context of MLS/listing-photo watermark removal increases concern because those watermarks commonly encode provenance or access-control expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This document explicitly guides watermark removal and recommends models and usage order, but it provides no warning about legal, ethical, provenance, or content-integrity risks. In the context of a dedicated watermark-removal skill, that omission increases the chance of facilitating unauthorized removal of ownership, attribution, or platform marks at scale.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/remove_watermark.py (reported line 186)May include surrounding context.

python

f"--output={out_dir}",
    ]

    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"IOPaint error: {result.stderr}")
        sys.exit(1)

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The detect→mask→inpaint sequence operationalizes a complete automated pipeline for erasing protective markings, making the misuse easy to scale across single files and batches. The danger comes from the end-to-end automation and normalization of a process that facilitates unauthorized alteration of images.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script writes output files, temporary masks, JSON summaries, and moved inpainted results without checking whether destination files already exist or prompting for confirmation. In batch use, this can silently overwrite prior outputs or clobber user data, causing integrity loss and unintended file modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.