Remove AI Watermarks

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:24 AM UTC
• Version: 1.0.8

Overview

This skill largely matches its stated watermark-removal purpose, but needs Review because it can direct an agent to probe the host and install or upgrade an unpinned external CLI without a clear user-consent gate.

Review this before installing if you do not want an agent to inspect local tool/GPU availability or modify your Python tool environment. Prefer approving installation explicitly, pinning a reviewed package version where possible, and using the skill only on media you own or are allowed to alter; do not use it to remove third-party commercial watermarks or make deceptive provenance claims.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/install.md:12
• Finding: Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `references/install.md`, lines 12–22 **Vulnerability Type**: Supply-chain exposure through unpinned dependencies **Risk Level**: Medium ### Vulnerable Code ```bash uv tool install --force "remove-ai-watermarks[visible]" ``` ```bash pipx install --force "remove-ai-watermarks[visible]" ``` ```bash python3 -m pip install --upgrade "remove-ai-watermarks[visible]" ``` ### Technical Analysis The installation instructions retrieve and install the latest available version of `remove-ai-watermarks` and its transitive dependencies. They do not specify an audited version, use a lockfile, require package hashes, or explicitly identify a trusted package index. The `--force` options for `uv` and `pipx`, and the `--upgrade` option for `pip`, can also replace an existing installation with whatever release the configured package index currently serves. Because the executable package is not included in the audited project, its downloaded code and dependency graph are outside the scope of this static review. This creates a supply-chain risk: a compromised package release, compromised transitive dependency, dependency-confusion condition, or maliciously configured package index could cause attacker-controlled code to be installed and subsequently executed. ### Attack Path 1. An attacker compromises a future release of `remove-ai-watermarks`, one of its transitive dependencies, or a package source configured in the target environment. 2. The Agent follows the documented installation procedure. 3. Because no version or hashes are pinned, the installer resolves the attacker-controlled package version. 4. The package and dependencies are installed or replace an existing installation. 5. Attacker-controlled code runs through installation behavior, package imports, or subsequent execution of the `remove-ai-watermarks` CLI. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the privileges of the ...[truncated 522 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to a reviewed release, for example: ```bash uv tool install --force "remove-ai-watermarks[visible]==<audited-version>" ``` 2. Maintain a lockfile or constraints file covering all transitive dependencies. 3. Require cryptographic hashes where the selected installer supports hash verification. 4. Explicitly use a trusted package index and ensure environment-level index overrides cannot silently redirect resolution. 5. Verify package provenance, release signatures, and published hashes before installation. 6. Avoid `--force` and `--upgrade` by default; use them only when replacement of an existing installation is required. 7. Rerun the project's capability probe after installation, while treating that functional check as complementary to—not a replacement for—dependency integrity verification.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is watermark/provenance handling, but the instructions also direct the agent to probe the environment, detect installers, assess CUDA/ffmpeg, and potentially install or upgrade software. This mismatch is risky because users or orchestration systems may invoke the skill expecting a narrow media operation, while it can also modify the host environment and expand execution surface through package-management actions.

Ae1

High

• Category: analysis-evasion

Content

The directory that contains this `SKILL.md` is the skill root. The working

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill instructs the agent to invoke shell commands and produce output files, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap: a harness may permit broader shell/file access than is necessary, increasing the chance of unintended command execution, package installation, or file modification beyond the user’s intent.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation text is broad enough to match common requests about whether a file is AI-generated or contains provenance data, even when the user did not intentionally request this skill. In context, that matters because the skill can lead to shell execution, probing, and possible installation or file-writing side effects, so over-broad routing increases the chance of surprising or unauthorized actions.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run(argv: list[str], timeout: float = 8.0) -> tuple[int, str, str]:
    try:
        proc = subprocess.run(  # noqa: S603
            argv,
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This probe inventories host characteristics well beyond core watermark processing, including Python runtime, CUDA/GPU presence, ffmpeg, installer/package-manager availability, and details about the installed CLI environment. In an agent setting, such host fingerprinting can expose unnecessary system information and expand the skill's visibility into the machine, which is especially concerning because the skill's stated purpose is media watermark removal/identification, not system reconnaissance.

Context-Inappropriate Capability

Low

• Confidence: 91% confidence
• Finding: The code explicitly checks for uv, pipx, pip, and brew to determine installation guidance. While not directly exploitative, enumerating package-management tooling is unrelated to the narrow media-processing task and contributes to host fingerprinting that could be misused by an agent or exposed in logs.

Static analysis

No suspicious patterns detected.