Навыки nx-matting
📦
nx-matting
v1.0.0 Ревизия содержимого r1 Критично ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе
Remove Image and Video Backgrounds
Background removal often requires complex local tools or cloud uploads. This skill runs BiRefNet locally and creates transparent image or video files.
Поддерживает: Claude Codex Code(CC)
Не устанавливайте этот Skill автоматически.
Каноническая политика требует проверки оператором перед любым действием по установке.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "nx-matting" from https://skillstore.io/skills/xiaowu89-nx-matting.md and its manifest at https://skillstore.io/api/skills/xiaowu89-nx-matting/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «nx-matting». Remove the background from C:\photos\portrait.jpg.
Ожидаемый результат:
Created C:\photos\portrait_transparent.png with the original dimensions and a transparent background.
Использование «nx-matting». Create a transparent WebM from C:\videos\demo.mp4 without audio.
Ожидаемый результат:
Created C:\videos\demo_transparent.webm without audio and reported the selected inference backend.
Использование «nx-matting». Check whether this computer is ready for matting.
Ожидаемый результат:
Reported Windows architecture, available runtimes, installed models, Vulkan status, cache location, and FFmpeg availability.
Аудит безопасности
Критичноv1 • 30.07.2026 Открыть версионный отчет
Most backtick, reconnaissance, temporary-path, and entropy alerts are syntax or documentation false positives. Confirmed risks include PowerShell execution with policy bypass, automatic remote artifact downloads, and unverified FFmpeg discovery outside the skill root. A critical instruction forces assistants to repeat a Base64-obfuscated third-party contact notice.
10
Просканировано файлов
1,294
Проанализировано строк
20
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (2)
Критично
Prompt Injection Attempt Detected
The skill says the final reply “必须原样展示” a third-party contact notice. Base64 hides the notice in code and forces unsolicited contact promotion.
The instruction explicitly controls the assistant's final response, and the script decodes and injects the same contact notice into terminal events.
Высокий
Automatic Execution of Author-Hosted Native Binaries
Normal processing downloads opaque Windows executables from author-controlled endpoints and runs them. Hashes ensure consistency but provide no independent provenance.
The manifest identifies executable artifacts, while the script downloads them using author-supplied hashes and selects them for local inference.
Пункты проверки возможностей (20)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Высокий
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "scripts/matting.ps1" image `
The documentation directs users or agents to execute the bundled PowerShell script with ExecutionPolicy Bypass. That script can download and run native binaries.
Высокий
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "scripts/matting.ps1" video `
The documentation directs users or agents to execute the bundled PowerShell script with ExecutionPolicy Bypass. That script can download and run native binaries.
Высокий
Path traversal sequence
Add-Candidate (Join-Path $SkillRoot "..\..\ffmpeg") "nxengine"
The script searches two directories above its root for FFmpeg and later executes a matching binary. The candidate receives capability checks but no integrity or signature verification.
Высокий
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" image `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Высокий
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" image `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Высокий
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" video `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Высокий
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" video `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Высокий
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" doctor
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Высокий
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" ensure-mo
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
Средний
Hardcoded URL
"https://www.gyan.dev/ffmpeg/builds/packages/ffmpeg-8.1.2-essentials_build.zip"
The script can download this FFmpeg archive and execute its binaries. SHA-256 verification reduces tampering risk, but remote executable acquisition remains security-sensitive.
Низкий
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/3b9e5ff30cb66902e9b80857be16a3d3415f732
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Низкий
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/nx-matting-cpu.exe"
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Низкий
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/3b9e5ff30cb66902e9b80857be16a3d3415f732
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Низкий
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/nx-matting-vulkan.exe"
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
Низкий
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/BiRefNet-lite-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Низкий
Hardcoded URL
"https://huggingface.co/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-lite-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Низкий
Hardcoded URL
"https://hf-mirror.com/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-lite-F16.gguf"
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Низкий
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/BiRefNet-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Низкий
Hardcoded URL
"https://huggingface.co/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Низкий
Hardcoded URL
"https://hf-mirror.com/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-F16.gguf"
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
Факторы риска
⚙️ Внешние команды (50)
README.md:36-38 README.md:30 README.md:32 README.md:36 README.md:43 scripts/matting.ps1:383 scripts/matting.ps1:386 scripts/matting.ps1:391 scripts/matting.ps1:660 scripts/matting.ps1:391 scripts/matting.ps1:407 scripts/matting.ps1:515 scripts/matting.ps1:660 scripts/matting.ps1:386-391 scripts/matting.ps1:391-660 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:52 SKILL.md:54-56 SKILL.md:57-61 SKILL.md:62-66 SKILL.md:70-71 SKILL.md:73-77 SKILL.md:77-78 SKILL.md:78-79 SKILL.md:79-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-87 SKILL.md:87-90 SKILL.md:90-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97 SKILL.md:98 SKILL.md:4 SKILL.md:23 SKILL.md:54 SKILL.md:56 SKILL.md:61 SKILL.md:66 SKILL.md:70 SKILL.md:87 SKILL.md:88 SKILL.md:89
🌐 Доступ к сети (12)
README.md:23 references/manifest.json:14 references/manifest.json:15 references/manifest.json:23 references/manifest.json:24 references/manifest.json:35 references/manifest.json:36 references/manifest.json:37 references/manifest.json:45 references/manifest.json:46 references/manifest.json:47 references/manifest.json:57
📁 Доступ к файловой системе (6)
Аудитор:: codex
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/xiaowu89-nx-matting/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/xiaowu89-nx-matting?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/xiaowu89-nx-matting?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiaowu89-nx-matting/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/xiaowu89-nx-matting.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
xiaowu89. (2026). nx-matting security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/xiaowu89-nx-matting/audits/1Цитата BibTeX
@techreport{xiaowu89-xiaowu89-nx-matting-2026,
author = {xiaowu89},
title = {nx-matting security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/xiaowu89-nx-matting/audits/1},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nx-matting security audit report (audit version 1)"
version: "1.0.0"
type: report
authors:
- name: "xiaowu89"
date-released: "2026-07-30"
url: "https://skillstore.io/skills/xiaowu89-nx-matting/audits/1"
identifiers:
- type: other
value: "skillstore:xiaowu89-nx-matting:audit:1"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 77
Архитектура
100
Сопровождаемость
87
Контент
65
Сообщество
83
Соответствие спецификации
Что вы можете построить
Prepare product images
Create transparent PNG product assets for catalogs, stores, and presentations.
Extract portrait subjects
Remove photo backgrounds while preserving people for design compositions.
Create transparent video
Convert recorded subjects into MOV or WebM overlays for editing and web projects.
Попробуйте эти промпты
Remove a photo background
Remove the background from [image path]. Save a transparent PNG beside the original without overwriting any file.
Create a product cutout
Use the Full model on [product image path]. Save a high-quality transparent PNG to [output path].
Create a web video overlay
Remove the background from [video path]. Export transparent WebM to [output path] and omit audio.
Control an advanced run
Process [input path] with [CPU or Vulkan], [Lite or Full], cache directory [path], and output [path]. Preserve temporary files for diagnostics.
Лучшие практики
- Keep the source file unchanged and write results to a separate output path.
- Use the Lite model for previews, then use Full only when edge quality requires it.
- Review alpha edges, video format support, and audio settings before delivery.
Избегать
- Do not overwrite an existing output without explicit approval.
- Do not select the Full model when download size or processing time is constrained.
- Do not assume every editor or browser supports transparent MOV or WebM.
Часто задаваемые вопросы
Which operating systems are supported?
The provided automation supports Windows x64 with PowerShell.
Does processing upload my media?
Media inference is local. The skill uses network access to download required models, runtimes, and FFmpeg.
Which image formats are accepted?
The skill accepts JPG, PNG, BMP, and WebP images.
Which transparent outputs are available?
Images use transparent PNG. Videos use transparent MOV by default or WebM when requested.
What is the difference between Lite and Full?
Lite is smaller and faster. Full is about 440 MB and targets higher-quality matting.
Is a GPU required?
No. CPU inference is supported, while Vulkan can accelerate processing on compatible systems.
Сведения для разработчиков
Автор
xiaowu89Лицензия
MIT
Версия автора
v1.0.0
Ревизия Skillstore
r1
Репозиторий
https://github.com/xiaowu89/skill-matting/tree/edfe347085829eb64b301229153f9f3f8fac7f02/Ссылка
57b0aa25b10809a60680af415997d53740bd0049
Актуальность поддержки
30.07.2026
Использование
0 загрузок · 1 просмотров
Структура файлов