PDF Watermark Remover

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:20 AM UTC
• Version: 1.0.0

Overview

This skill is a local PDF watermark-removal helper whose risky behavior is mostly disclosed and user-triggered, though users should review outputs because it edits PDF content heuristically.

Install and run this only in a normal least-privileged Python environment, keep an original copy of each PDF, review the output before replacing anything, and use --remove-links only with a specific --link-domain when the watermark link domain is known.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:106

Finding

Unpinned PyMuPDF Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:106 and scripts/remove_watermark.py:18
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Affected code in SKILL.md:106:

text

- pymupdf (`pip install pymupdf`)

Affected code in scripts/remove_watermark.py:17-18:

text

Requirements:
    pip install pymupdf

Technical Analysis

The documented installation command retrieves the latest package matching the pymupdf name from pip's configured package index. The project does not provide a reviewed version constraint, lockfile, package hash, or trusted-index restriction.

As a result, the dependency resolved at installation time can differ from the version that existed when the Skill was audited. If the upstream package, its publishing account, the configured package index, or the dependency-resolution environment is compromised, a malicious release could be installed. Python packages can execute code during installation or when imported by the script at scripts/remove_watermark.py:169.

This is a supply-chain weakness rather than evidence that the current PyMuPDF package or this project contains a malicious payload.

Attack Path

1. An attacker compromises the upstream package publication process, a package-index account, or an index configured in the user's pip environment.
2. The attacker publishes or serves a malicious version under the expected pymupdf package name.
3. A user follows the documented pip install pymupdf instruction without a version or hash constraint.
4. pip resolves and installs the attacker-controlled release.
5. Malicious package code executes during installation or when import fitz runs.
6. The payload operates with the permissions of the user or automation account running pip or the watermark-removal script.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the priv ...[truncated 532 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin PyMuPDF to a specifically reviewed version, for example:

   text

   pymupdf==<reviewed-version>
   

2. Maintain dependencies in a lockfile or requirements file with cryptographic hashes.
3. Install with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Generate hashes from trusted artifacts and review them before committing the dependency file.
5. Explicitly configure an approved package index and prevent fallback to untrusted indexes.
6. Run dependency installation and PDF processing in an isolated, least-privileged virtual environment or container.
7. Add automated dependency vulnerability and provenance checks to the release process.
8. Update both SKILL.md and the script documentation so they reference the same secured installation procedure.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script offers functionality to delete PDF link annotations, which exceeds the stated purpose of watermark removal and can remove legitimate document content or attribution links. Because the default behavior can remove all URI-bearing annotations when enabled without tightly coupling that action to verified watermark artifacts, a user or downstream agent could use the skill to strip links unrelated to watermarks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Bulk link-annotation removal is broader than necessary for the advertised task and can delete benign navigation, citations, or embedded references from a PDF. In an agent setting, this creates a capability mismatch where a user asking to remove a watermark may unintentionally lose unrelated interactive content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The tool performs destructive content-stream and object-dictionary edits and then saves a modified PDF without an explicit warning that detection is heuristic and may remove legitimate images or links. This is risky because false positives could silently damage document contents, especially when run by an automated agent on untrusted or varied PDFs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The documentation understates the skill's capabilities by presenting it as an image-watermark remover while also exposing generic link-annotation deletion. This mismatch increases the chance that users, reviewers, or orchestrating agents invoke the skill under incorrect assumptions, leading to unintended destructive edits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.