Remove Watermark

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:38 PM UTC
• Version: 0.1.0

Overview

This skill locally edits document images to remove watermarks and has caution-worthy documentation and dependency issues, but I found no hidden access, exfiltration, persistence, or unrelated destructive behavior.

Install only if you are comfortable with a local script modifying copies of your document images. Keep originals, review outputs before using them, avoid using it to alter official or evidentiary documents, and prefer a pinned or isolated Python environment for the dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-18, 35-35, and 44-47
Vulnerability Type: Unpinned third-party dependencies resolved and installed at runtime
Risk Level: Medium

Vulnerable Code

markdown

Use `uv run --with Pillow --with numpy` (add `--with scipy` only when using `--region full`).

bash

uv run --with Pillow --with numpy python3 <skill-path>/scripts/remove_watermark.py analyze <image> --region "y0,y1,x0,x1"

bash

uv run --with Pillow --with numpy python3 <skill-path>/scripts/remove_watermark.py remove <input> -o <output> --region "y0,y1,x0,x1" --threshold <N>

uv run --with Pillow --with numpy --with scipy python3 <skill-path>/scripts/remove_watermark.py remove <input> -o <output> --threshold <N>

Technical Analysis

The documented commands instruct the Agent to use uv run --with to resolve and install Pillow, numpy, and optionally scipy without exact version constraints, a committed lockfile, or artifact integrity hashes.

Consequently, the executable dependency set can change between otherwise identical runs. Although the package names are legitimate and no malicious package is present in the audited repository, the workflow relies on the security of the configured package index, the selected package releases, and all transitive dependencies. If any resolved artifact or distribution channel is compromised, installation hooks or import-time Python code could execute within the Agent process.

Attack Path

1. A user or Agent follows the commands in SKILL.md.
2. uv contacts the configured Python package source and resolves the current versions of the named packages and their transitive dependencies.
3. A compromised release, dependency, package-index response, or repository configuration causes a malicious artifact to be selected.
4. The artifact is downloaded and installed into the runtime environment.
5. Malicious installation or import-time code executes when the image-process ...[truncated 884 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an reviewed exact version rather than resolving unconstrained current releases.
2. Commit a generated uv.lock file that captures direct and transitive dependencies.
3. Execute the workflow with locked resolution, such as uv run --locked, and fail if the lockfile is inconsistent.
4. Use an approved, explicitly configured package index or an internally controlled package mirror.
5. Verify downloaded artifacts with cryptographic hashes or repository-supported integrity controls.
6. Periodically scan and deliberately update the lockfile rather than permitting automatic version drift on every invocation.
7. Where operationally practical, build a pre-approved isolated environment or container so routine Skill execution does not install packages dynamically.
8. Run the image-processing command under least privilege, with access limited to required input and output paths and without unnecessary credentials in its environment.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs repeated watermark-removal attempts, including aggressive thresholds like 'threshold=1' and advice that blanking a region may be 'safe,' without prominent warnings about irreversible content loss or evidentiary/document integrity risks. In the context of exam papers and scanned documents, this is more dangerous because users may alter substantive text or produce misleading cleaned documents while assuming the process is harmless.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation makes absolute safety claims such as 'zero damage' and 'perfectly intact' even though the same workflow later admits text can be damaged or lightened and may require retries. This can mislead an agent or user into applying destructive image edits with insufficient caution, increasing the chance of accidental alteration of document content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.