免费图片解决方案

• Outcome: Review
• Latest audit: May 28, 2026 · 2:19 PM UTC
• Version: 1.0.0

Overview

This image skill is not malware, but it needs Review because it normalizes watermark removal and handles API keys/spending with weak safeguards.

Install only after reviewing the watermark workflow and credential handling. Use a virtual environment, avoid --break-system-packages, do not echo or share API keys, set hard OpenAI billing limits, and only process images you own or are explicitly authorized to modify.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]
        
        try:
            subprocess.run(cmd, check=True, capture_output=True)
            processed.append(str(output_file))
            print(f"  ✅ {filepath.name} → {output_file.name}")
        except subprocess.CalledProcessError as e:

• Confidence: 87% confidence
• Finding: The script passes attacker-controlled file paths directly to ImageMagick's `convert` binary. Although `subprocess.run` is used safely without a shell, ImageMagick itself has a long history of dangerous parser/delegate behaviors, so processing untrusted images can trigger file read, SSRF, or code-execution issues in the external tool.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = ["convert", str(filepath), str(output_file)]
        
        try:
            subprocess.run(cmd, check=True, capture_output=True)
            processed.append(str(output_file))
            print(f"  ✅ {filepath.name} → {output_file.name}")
        except subprocess.CalledProcessError as e:

• Confidence: 87% confidence
• Finding: This conversion path also sends user-supplied image files into ImageMagick. Even without shell injection, invoking a complex external image processor on untrusted content expands attack surface and can expose the host to ImageMagick parsing vulnerabilities or unintended access to remote/local resources via crafted image formats.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = ["convert", str(filepath), "-quality", str(quality), str(output_file)]
        
        try:
            subprocess.run(cmd, check=True, capture_output=True)
            
            # 计算文件大小变化
            orig_size = filepath.stat().st_size

• Confidence: 86% confidence
• Finding: Quality optimization likewise invokes ImageMagick on potentially untrusted files. The risk is not shell command injection but unsafe delegation of parsing to an external binary that may be exploitable through malicious image content or abused for denial of service through decompression/resource exhaustion.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documentation advertises and requires capabilities including environment-variable access, network access, file read/write, and shell execution, yet no explicit permissions are declared. This weakens trust boundaries and informed consent because users cannot easily evaluate what the skill may access or execute before installation or use.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The configuration explicitly enables automatic watermark removal while presenting the skill as a free-image solution based on legitimate free sources. Watermark removal is not necessary to fulfill that purpose and can facilitate circumvention of copyright protections, increasing legal and compliance risk for downstream users.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Automatic watermark removal is unjustified in a tool whose stated purpose is sourcing free images, making the feature suspicious and inherently risky. In this context, it can be used to strip ownership indicators from licensed content, enabling unauthorized reuse and making abuse easier at scale.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The README explicitly documents a watermark removal feature as a normal part of the workflow, even though the skill is presented as a free-image sourcing solution. In this context, watermark removal materially enables misuse against licensed or attribution-required content and increases legal, copyright, and policy-evasion risk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The complete workflow automates watermark removal as a default processing step, which operationalizes potentially unauthorized alteration of third-party images. Embedding it in an end-to-end script makes misuse easier and more scalable than a standalone mention.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The example workflow explicitly promotes obtaining images that are 'watermark-free or removable' and then removing watermarks as a normal processing step. That meaningfully facilitates copyright and license circumvention, which can expose users to legal liability and encourages misuse of third-party content rather than compliant sourcing.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The script claims real-use code is still commented out, but it already performs live API calls and writes files to disk. This mismatch can mislead operators into running billable and network-active behavior they did not intend, increasing the risk of unauthorized spend and unsafe execution in automated environments.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file presents itself as an intelligent watermark removal tool, but the implementation only writes placeholder text files and simulated status output. In a skill ecosystem, this is dangerous because it misrepresents capability, can mislead downstream automation into thinking image sanitization occurred, and could cause users to rely on nonexistent processing for compliance, publishing, or content handling workflows.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The broader skill promises automatic watermark removal, but this script generates mock artifacts and a JSON record instead of cleaned images. This mismatch can deceive users or automated agents into distributing unprocessed or improperly handled media, especially risky given the skill context explicitly advertises watermark removal as a solution.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill prominently promotes automatic watermark removal, which can facilitate copyright infringement, license circumvention, and misuse of protected media. The brief ethical note is insufficient because the workflow presents the feature as a normal convenience function rather than a restricted, high-risk action with strong compliance safeguards.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: Enabling watermark removal by default and without explicit opt-in creates a high-risk behavior that users may invoke unintentionally or abuse deliberately. Because the skill is marketed around free imagery, the default automation makes the mismatch more dangerous by normalizing potentially infringing processing of third-party content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README demonstrates watermark removal without any warning about copyright, licensing, attribution, or authorization requirements. This omission lowers user friction for improper use and makes a risky capability appear routine and acceptable.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Automating watermark removal in the workflow without any warning or gating normalizes a potentially unlawful action and encourages unattended bulk processing. In a skill marketed around obtaining free images, that context makes the omission more dangerous because users may apply it to content they do not own.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The troubleshooting example tells users to print the OPENAI_API_KEY environment variable and test live API connectivity without any caution about credential exposure, shell history, logging, or network transmission. While this is a common debugging pattern, it can lead to accidental secret disclosure in shared terminals, screenshots, recordings, or CI logs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow describes downloading and processing third-party images, including watermark removal, but omits any warning about copyright, license terms, attribution, or authenticity/integrity concerns. In this context, the omission is risky because the skill is framed as a practical automation guide and could normalize legally noncompliant image handling.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The documentation tells users to source a local environment file containing API credentials without any guidance on secure storage, permissions, or review of file contents. In an agent-skill context, encouraging credential loading from an arbitrary shell script can expose secrets or execute unintended shell commands if the file is modified, misplaced, or copied from an untrusted source.

Ssd 4

Medium

• Confidence: 94% confidence
• Finding: Across the README, watermark removal is framed as an ordinary cleanup stage after obtaining 'free' images, creating a deceptive narrative that obscures licensing boundaries. This sequencing can steer users toward unauthorized alteration of images from mixed-license sources and makes the skill more dangerous than a simple downloader.

Ssd 4

Medium

• Confidence: 97% confidence
• Finding: The document creates a step-by-step narrative: search for images that are watermark-free or removable, download them, and then remove watermarks in post-processing. That sequencing is more dangerous than a stray mention because it operationalizes copyright-restriction evasion as a workflow users can follow directly.

Static analysis

No suspicious patterns detected.