WaveSpeedAI Watermark Remover

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:13 AM UTC
• Version: 2.0.1

Overview

The skill is a coherent WaveSpeed watermark-removal integration with clear responsible-use limits, though users should be cautious about unpinned npm setup commands and media uploads.

Install only if you are comfortable using WaveSpeed's cloud service for the specific media you provide. Prefer pinning reviewed package versions, avoid elevated shells, use a least-privileged environment, and only process media you own or are licensed to modify.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-30
Vulnerability Type: Supply-chain exposure caused by unpinned npm packages
Risk Level: Medium

Vulnerable Code

bash

npm install -g @wavespeed/cli
wavespeed login          # opens https://wavespeed.ai/accesskey and stores the key
wavespeed status         # confirms you are signed in

text

npx -y @wavespeed/mcp

Technical Analysis

The setup instructions install @wavespeed/cli globally and execute @wavespeed/mcp without specifying reviewed, exact package versions or verifying package integrity. In particular, npx -y automatically resolves, downloads, and executes the package selected by the npm registry without presenting an installation confirmation.

Because the effective package contents can change after this Skill has been reviewed, compromise of the package publisher, npm registry account, or a transitive dependency could cause attacker-controlled JavaScript, lifecycle scripts, or executable entry points to run with the invoking user's permissions. Global installation also expands the package's presence beyond an isolated project environment.

No evidence establishes that the named packages are currently malicious. The vulnerability is the unsafe and mutable dependency acquisition process prescribed by the Skill.

Attack Path

1. An attacker compromises the publisher account, package release process, or a transitive dependency associated with one of the referenced npm packages.
2. The attacker publishes a malicious version under the legitimate package name.
3. A user follows the Skill instructions and runs npm install -g @wavespeed/cli or npx -y @wavespeed/mcp.
4. npm resolves the unpinned dependency to the attacker-controlled release.
5. Package lifecycle scripts or executable entry points run locally with the user's privileges.
6. The malicious code may inspect accessible files and environment variable ...[truncated 690 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each package to a reviewed exact version, such as @wavespeed/cli@X.Y.Z and @wavespeed/mcp@X.Y.Z, rather than resolving the latest available release.
• Replace npx -y with execution of a locally installed, version-pinned dependency.
• Use a project-local installation instead of a global installation wherever practical, and commit a lockfile containing integrity hashes.
• Verify package provenance, signatures, integrity metadata, publisher identity, and release history before installation.
• Run dependency installation and model processing in a least-privileged, isolated environment with access limited to the media required for the current task.
• Disable npm lifecycle scripts during installation where compatible, then explicitly review any scripts that must be enabled.
• Establish a controlled dependency-update process that reviews and tests new versions before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Setup

Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat:

bash

npm install -g @wavespeed/cli

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run an unpinned package via npx -y @wavespeed/mcp, which fetches the latest published code at execution time. If the package is compromised, typosquatted, or a malicious update is released, users may execute attacker-controlled code in their environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.