Security audit

Watermark Pro

Security checks for vulnerabilities and agentic risk

Overview

This is a local watermarking helper with ordinary document-processing behavior and some fixable dependency, temporary-file, and compatibility issues.

Install dependencies in an isolated virtual environment, prefer pinned package versions, and use a private output directory when watermarking PDFs. Treat the 'no privacy risk' statement as too absolute: files are processed locally, but sensitive documents are still read and rewritten by the Python libraries.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:7
Finding: Unpinned Third-Party Python Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:174
Finding: Predictable Temporary File Permits Symlink and Concurrency Attacks
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description begins in Chinese and the skill content is predominantly written as Chinese-only instructions, while also advertising English trigger phrases. This creates a locale/language policy concern because the skill appears to assume a specific language without explicit user opt-in or a stated language-selection mechanism.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The note at L209 states the skill is "跨平台兼容" (cross-platform compatible), yet both image and PDF watermark implementations load '/System/Library/Fonts/PingFang.ttc', which is a macOS-specific system font path (L051, L163). Although the code falls back to a default font, that behavior does not match the explicit compatibility claim and can change rendering capability across platforms, especially for Chinese text.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.
text
permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Static analysis

No suspicious patterns detected.