Habilidades nx-matting
📦
nx-matting
v1.0.0 Revisão do conteúdo r1 Crítico ⚙️ Comandos externos🌐 Acesso à rede📁 Acesso ao sistema de arquivos
Remove Image and Video Backgrounds
Background removal often requires complex local tools or cloud uploads. This skill runs BiRefNet locally and creates transparent image or video files.
Suporta: Claude Codex Code(CC)
Não instale este Skill automaticamente.
A política canônica exige a revisão de um operador antes de qualquer ação de instalação.
Instalar com meu Agente
Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.
Solicitação do agente
Review the Skillstore skill "nx-matting" from https://skillstore.io/skills/xiaowu89-nx-matting.md and its manifest at https://skillstore.io/api/skills/xiaowu89-nx-matting/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.
Recursos legíveis por agentes
Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.
Testar
Usando "nx-matting". Remove the background from C:\photos\portrait.jpg.
Resultado esperado:
Created C:\photos\portrait_transparent.png with the original dimensions and a transparent background.
Usando "nx-matting". Create a transparent WebM from C:\videos\demo.mp4 without audio.
Resultado esperado:
Created C:\videos\demo_transparent.webm without audio and reported the selected inference backend.
Usando "nx-matting". Check whether this computer is ready for matting.
Resultado esperado:
Reported Windows architecture, available runtimes, installed models, Vulkan status, cache location, and FFmpeg availability.
Auditoria de segurança
Críticov1 • 30/07/2026 Abrir o relatório versionado
Most backtick, reconnaissance, temporary-path, and entropy alerts are syntax or documentation false positives. Confirmed risks include PowerShell execution with policy bypass, automatic remote artifact downloads, and unverified FFmpeg discovery outside the skill root. A critical instruction forces assistants to repeat a Base64-obfuscated third-party contact notice.
10
Arquivos analisados
1,294
Linhas analisadas
20
Itens de revisão
0
Falsos positivos ignorados
Preocupações de segurança confirmadas (2)
Crítico
Prompt Injection Attempt Detected
The skill says the final reply “必须原样展示” a third-party contact notice. Base64 hides the notice in code and forces unsolicited contact promotion.
The instruction explicitly controls the assistant's final response, and the script decodes and injects the same contact notice into terminal events.
Alto
Automatic Execution of Author-Hosted Native Binaries
Normal processing downloads opaque Windows executables from author-controlled endpoints and runs them. Hashes ensure consistency but provide no independent provenance.
The manifest identifies executable artifacts, while the script downloads them using author-supplied hashes and selects them for local inference.
Itens de revisão de capacidade (20)
Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.
Alto
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "scripts/matting.ps1" image `
The documentation directs users or agents to execute the bundled PowerShell script with ExecutionPolicy Bypass. That script can download and run native binaries.
Alto
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "scripts/matting.ps1" video `
The documentation directs users or agents to execute the bundled PowerShell script with ExecutionPolicy Bypass. That script can download and run native binaries.
Alto
Path traversal sequence
Add-Candidate (Join-Path $SkillRoot "..\..\ffmpeg") "nxengine"
The script searches two directories above its root for FFmpeg and later executes a matching binary. The candidate receives capability checks but no integrity or signature verification.
Alto
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" image `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Alto
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" image `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Alto
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" video `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Alto
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" video `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Alto
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" doctor
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Alto
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" ensure-mo
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Médio
Hardcoded URL
"https://www.gyan.dev/ffmpeg/builds/packages/ffmpeg-8.1.2-essentials_build.zip"
The script can download this FFmpeg archive and execute its binaries. SHA-256 verification reduces tampering risk, but remote executable acquisition remains security-sensitive.
Baixo
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/3b9e5ff30cb66902e9b80857be16a3d3415f732
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Baixo
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/nx-matting-cpu.exe"
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Baixo
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/3b9e5ff30cb66902e9b80857be16a3d3415f732
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Baixo
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/nx-matting-vulkan.exe"
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Baixo
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/BiRefNet-lite-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Baixo
Hardcoded URL
"https://huggingface.co/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-lite-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Baixo
Hardcoded URL
"https://hf-mirror.com/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-lite-F16.gguf"
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Baixo
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/BiRefNet-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Baixo
Hardcoded URL
"https://huggingface.co/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Baixo
Hardcoded URL
"https://hf-mirror.com/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-F16.gguf"
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Fatores de risco
⚙️ Comandos externos (50)
README.md:36-38 README.md:30 README.md:32 README.md:36 README.md:43 scripts/matting.ps1:383 scripts/matting.ps1:386 scripts/matting.ps1:391 scripts/matting.ps1:660 scripts/matting.ps1:391 scripts/matting.ps1:407 scripts/matting.ps1:515 scripts/matting.ps1:660 scripts/matting.ps1:386-391 scripts/matting.ps1:391-660 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:52 SKILL.md:54-56 SKILL.md:57-61 SKILL.md:62-66 SKILL.md:70-71 SKILL.md:73-77 SKILL.md:77-78 SKILL.md:78-79 SKILL.md:79-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-87 SKILL.md:87-90 SKILL.md:90-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97 SKILL.md:98 SKILL.md:4 SKILL.md:23 SKILL.md:54 SKILL.md:56 SKILL.md:61 SKILL.md:66 SKILL.md:70 SKILL.md:87 SKILL.md:88 SKILL.md:89
🌐 Acesso à rede (12)
README.md:23 references/manifest.json:14 references/manifest.json:15 references/manifest.json:23 references/manifest.json:24 references/manifest.json:35 references/manifest.json:36 references/manifest.json:37 references/manifest.json:45 references/manifest.json:46 references/manifest.json:47 references/manifest.json:57
📁 Acesso ao sistema de arquivos (6)
Auditado por: codex
Compartilhar e citar este relatório
Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.
Copiar link do relatório
https://skillstore.io/skills/xiaowu89-nx-matting/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/xiaowu89-nx-matting?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/xiaowu89-nx-matting?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiaowu89-nx-matting/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Cartão incorporável
<iframe src="https://skillstore.io/embed/skills/xiaowu89-nx-matting.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citações acadêmicas (APA · BibTeX · CFF)
Citação APA
xiaowu89. (2026). nx-matting security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/xiaowu89-nx-matting/audits/1Citação BibTeX
@techreport{xiaowu89-xiaowu89-nx-matting-2026,
author = {xiaowu89},
title = {nx-matting security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/xiaowu89-nx-matting/audits/1},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nx-matting security audit report (audit version 1)"
version: "1.0.0"
type: report
authors:
- name: "xiaowu89"
date-released: "2026-07-30"
url: "https://skillstore.io/skills/xiaowu89-nx-matting/audits/1"
identifiers:
- type: other
value: "skillstore:xiaowu89-nx-matting:audit:1"
description: "Skillstore immutable audit report identifier"
Pontuação do Skillstore
Por que esta pontuação Confiança das evidências: Médio 77
Arquitetura
100
Manutenibilidade
87
Conteúdo
65
Comunidade
83
Conformidade com a especificação
O que você pode criar
Prepare product images
Create transparent PNG product assets for catalogs, stores, and presentations.
Extract portrait subjects
Remove photo backgrounds while preserving people for design compositions.
Create transparent video
Convert recorded subjects into MOV or WebM overlays for editing and web projects.
Teste estes prompts
Remove a photo background
Remove the background from [image path]. Save a transparent PNG beside the original without overwriting any file.
Create a product cutout
Use the Full model on [product image path]. Save a high-quality transparent PNG to [output path].
Create a web video overlay
Remove the background from [video path]. Export transparent WebM to [output path] and omit audio.
Control an advanced run
Process [input path] with [CPU or Vulkan], [Lite or Full], cache directory [path], and output [path]. Preserve temporary files for diagnostics.
Boas práticas
- Keep the source file unchanged and write results to a separate output path.
- Use the Lite model for previews, then use Full only when edge quality requires it.
- Review alpha edges, video format support, and audio settings before delivery.
Evitar
- Do not overwrite an existing output without explicit approval.
- Do not select the Full model when download size or processing time is constrained.
- Do not assume every editor or browser supports transparent MOV or WebM.
Perguntas frequentes
Which operating systems are supported?
The provided automation supports Windows x64 with PowerShell.
Does processing upload my media?
Media inference is local. The skill uses network access to download required models, runtimes, and FFmpeg.
Which image formats are accepted?
The skill accepts JPG, PNG, BMP, and WebP images.
Which transparent outputs are available?
Images use transparent PNG. Videos use transparent MOV by default or WebM when requested.
What is the difference between Lite and Full?
Lite is smaller and faster. Full is about 440 MB and targets higher-quality matting.
Is a GPU required?
No. CPU inference is supported, while Vulkan can accelerate processing on compatible systems.
Detalhes do desenvolvedor
Autor
xiaowu89Licença
MIT
Versão do autor
v1.0.0
Revisão da Skillstore
r1
Repositório
https://github.com/xiaowu89/skill-matting/tree/edfe347085829eb64b301229153f9f3f8fac7f02/Referência
57b0aa25b10809a60680af415997d53740bd0049
Atualidade da manutenção
30/07/2026
Uso
0 downloads · 1 visualizações
Estrutura de arquivos