Compétences nx-matting
📦
nx-matting
v1.0.0 Révision du contenu r1 Critique ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers
Remove Image and Video Backgrounds
Background removal often requires complex local tools or cloud uploads. This skill runs BiRefNet locally and creates transparent image or video files.
Prend en charge: Claude Codex Code(CC)
N’installez pas automatiquement ce Skill.
La politique de référence exige un examen par un opérateur avant toute action d’installation.
Installer avec mon Agent
Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.
Demande d’agent
Review the Skillstore skill "nx-matting" from https://skillstore.io/skills/xiaowu89-nx-matting.md and its manifest at https://skillstore.io/api/skills/xiaowu89-nx-matting/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.
Ressources lisibles par les agents
Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.
Tester
Utilisation de « nx-matting ». Remove the background from C:\photos\portrait.jpg.
Résultat attendu:
Created C:\photos\portrait_transparent.png with the original dimensions and a transparent background.
Utilisation de « nx-matting ». Create a transparent WebM from C:\videos\demo.mp4 without audio.
Résultat attendu:
Created C:\videos\demo_transparent.webm without audio and reported the selected inference backend.
Utilisation de « nx-matting ». Check whether this computer is ready for matting.
Résultat attendu:
Reported Windows architecture, available runtimes, installed models, Vulkan status, cache location, and FFmpeg availability.
Audit de sécurité
Critiquev1 • 30/07/2026 Ouvrir le rapport versionné
Most backtick, reconnaissance, temporary-path, and entropy alerts are syntax or documentation false positives. Confirmed risks include PowerShell execution with policy bypass, automatic remote artifact downloads, and unverified FFmpeg discovery outside the skill root. A critical instruction forces assistants to repeat a Base64-obfuscated third-party contact notice.
10
Fichiers analysés
1,294
Lignes analysées
20
Éléments à examiner
0
Faux positifs ignorés
Préoccupations de sécurité confirmées (2)
Critique
Prompt Injection Attempt Detected
The skill says the final reply “必须原样展示” a third-party contact notice. Base64 hides the notice in code and forces unsolicited contact promotion.
The instruction explicitly controls the assistant's final response, and the script decodes and injects the same contact notice into terminal events.
Élevé
Automatic Execution of Author-Hosted Native Binaries
Normal processing downloads opaque Windows executables from author-controlled endpoints and runs them. Hashes ensure consistency but provide no independent provenance.
The manifest identifies executable artifacts, while the script downloads them using author-supplied hashes and selects them for local inference.
Éléments d’évaluation des capacités (20)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
Élevé
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "scripts/matting.ps1" image `
The documentation directs users or agents to execute the bundled PowerShell script with ExecutionPolicy Bypass. That script can download and run native binaries.
Élevé
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "scripts/matting.ps1" video `
The documentation directs users or agents to execute the bundled PowerShell script with ExecutionPolicy Bypass. That script can download and run native binaries.
Élevé
Path traversal sequence
Add-Candidate (Join-Path $SkillRoot "..\..\ffmpeg") "nxengine"
The script searches two directories above its root for FFmpeg and later executes a matching binary. The candidate receives capability checks but no integrity or signature verification.
Élevé
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" image `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Élevé
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" image `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Élevé
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" video `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Élevé
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" video `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Élevé
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" doctor
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Élevé
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" ensure-mo
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Moyen
Hardcoded URL
"https://www.gyan.dev/ffmpeg/builds/packages/ffmpeg-8.1.2-essentials_build.zip"
The script can download this FFmpeg archive and execute its binaries. SHA-256 verification reduces tampering risk, but remote executable acquisition remains security-sensitive.
Faible
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/3b9e5ff30cb66902e9b80857be16a3d3415f732
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Faible
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/nx-matting-cpu.exe"
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Faible
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/3b9e5ff30cb66902e9b80857be16a3d3415f732
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Faible
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/nx-matting-vulkan.exe"
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Faible
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/BiRefNet-lite-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Faible
Hardcoded URL
"https://huggingface.co/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-lite-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Faible
Hardcoded URL
"https://hf-mirror.com/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-lite-F16.gguf"
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Faible
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/BiRefNet-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Faible
Hardcoded URL
"https://huggingface.co/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Faible
Hardcoded URL
"https://hf-mirror.com/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-F16.gguf"
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Facteurs de risque
⚙️ Commandes externes (50)
README.md:36-38 README.md:30 README.md:32 README.md:36 README.md:43 scripts/matting.ps1:383 scripts/matting.ps1:386 scripts/matting.ps1:391 scripts/matting.ps1:660 scripts/matting.ps1:391 scripts/matting.ps1:407 scripts/matting.ps1:515 scripts/matting.ps1:660 scripts/matting.ps1:386-391 scripts/matting.ps1:391-660 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:52 SKILL.md:54-56 SKILL.md:57-61 SKILL.md:62-66 SKILL.md:70-71 SKILL.md:73-77 SKILL.md:77-78 SKILL.md:78-79 SKILL.md:79-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-87 SKILL.md:87-90 SKILL.md:90-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97 SKILL.md:98 SKILL.md:4 SKILL.md:23 SKILL.md:54 SKILL.md:56 SKILL.md:61 SKILL.md:66 SKILL.md:70 SKILL.md:87 SKILL.md:88 SKILL.md:89
🌐 Accès réseau (12)
README.md:23 references/manifest.json:14 references/manifest.json:15 references/manifest.json:23 references/manifest.json:24 references/manifest.json:35 references/manifest.json:36 references/manifest.json:37 references/manifest.json:45 references/manifest.json:46 references/manifest.json:47 references/manifest.json:57
📁 Accès au système de fichiers (6)
Audité par: codex
Partager et citer ce rapport
Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.
Copier le lien du rapport
https://skillstore.io/skills/xiaowu89-nx-matting/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/xiaowu89-nx-matting?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/xiaowu89-nx-matting?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiaowu89-nx-matting/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Carte intégrable
<iframe src="https://skillstore.io/embed/skills/xiaowu89-nx-matting.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citations académiques (APA · BibTeX · CFF)
Citation APA
xiaowu89. (2026). nx-matting security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/xiaowu89-nx-matting/audits/1Citation BibTeX
@techreport{xiaowu89-xiaowu89-nx-matting-2026,
author = {xiaowu89},
title = {nx-matting security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/xiaowu89-nx-matting/audits/1},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nx-matting security audit report (audit version 1)"
version: "1.0.0"
type: report
authors:
- name: "xiaowu89"
date-released: "2026-07-30"
url: "https://skillstore.io/skills/xiaowu89-nx-matting/audits/1"
identifiers:
- type: other
value: "skillstore:xiaowu89-nx-matting:audit:1"
description: "Skillstore immutable audit report identifier"
Score Skillstore
Pourquoi ce score Niveau de confiance des preuves: Moyen 77
Architecture
100
Maintenabilité
87
Contenu
65
Communauté
83
Conformité aux spécifications
Ce que vous pouvez créer
Prepare product images
Create transparent PNG product assets for catalogs, stores, and presentations.
Extract portrait subjects
Remove photo backgrounds while preserving people for design compositions.
Create transparent video
Convert recorded subjects into MOV or WebM overlays for editing and web projects.
Essayez ces prompts
Remove a photo background
Remove the background from [image path]. Save a transparent PNG beside the original without overwriting any file.
Create a product cutout
Use the Full model on [product image path]. Save a high-quality transparent PNG to [output path].
Create a web video overlay
Remove the background from [video path]. Export transparent WebM to [output path] and omit audio.
Control an advanced run
Process [input path] with [CPU or Vulkan], [Lite or Full], cache directory [path], and output [path]. Preserve temporary files for diagnostics.
Bonnes pratiques
- Keep the source file unchanged and write results to a separate output path.
- Use the Lite model for previews, then use Full only when edge quality requires it.
- Review alpha edges, video format support, and audio settings before delivery.
Éviter
- Do not overwrite an existing output without explicit approval.
- Do not select the Full model when download size or processing time is constrained.
- Do not assume every editor or browser supports transparent MOV or WebM.
Foire aux questions
Which operating systems are supported?
The provided automation supports Windows x64 with PowerShell.
Does processing upload my media?
Media inference is local. The skill uses network access to download required models, runtimes, and FFmpeg.
Which image formats are accepted?
The skill accepts JPG, PNG, BMP, and WebP images.
Which transparent outputs are available?
Images use transparent PNG. Videos use transparent MOV by default or WebM when requested.
What is the difference between Lite and Full?
Lite is smaller and faster. Full is about 440 MB and targets higher-quality matting.
Is a GPU required?
No. CPU inference is supported, while Vulkan can accelerate processing on compatible systems.
Détails du développeur
Auteur
xiaowu89Licence
MIT
Version de l’auteur
v1.0.0
Révision Skillstore
r1
Réf
57b0aa25b10809a60680af415997d53740bd0049
Récence de maintenance
30/07/2026
Utilisation
0 téléchargements · 1 vues
Structure de fichiers