Versioned security assessment

Report ID: SA-74160C74

6/30/2026, 10:15:10 PM

background-remover security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
background-remover
Version
v3
Maintainer
verging.ai
Source
github.com/verging-ai/agent-skills/tree/main/skills/background-removal
Coverage
1 Files scanned · 239 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis found many command, network, environment, filesystem, and weak-cryptography patterns. Review confirms legitimate third-party API behavior for image processing, but the skill sends API keys and images to external services and returns public result URLs. No prompt injection, bundled malware, or confirmed malicious intent was found; weak-cryptography alerts are false positives from Markdown text.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 239 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 8 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 7 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 7 evidence locations

Capability review items (3)
Medium
SKILL.md:153-156SKILL.md:235-237
Third-Party Image Upload and Public Result URL
The skill instructs agents to upload user images to verging.ai and R2 storage, then return processed images through a public URL. This is legitimate for the advertised service, but it creates privacy and data exposure risk for sensitive images.
The documented processing flow explicitly uploads images and stores results behind public URLs. The behavior matches the skill purpose, so the risk is privacy exposure rather than confirmed malicious intent.
Medium
SKILL.md:42SKILL.md:87-91SKILL.md:110-121SKILL.md:214SKILL.md:231
API Key Used in Credentialed Network Requests
The skill requires VERGING_API_KEY or an explicit API key and sends it in Authorization headers for curl requests. This is expected for the service, but copied commands or command-line flags can expose secrets through logs, shell history, or process listings.
The API key requirement and Authorization header examples are explicit. The endpoint is the advertised provider, so this is an operational secret-handling concern rather than evidence of exfiltration.
Medium
SKILL.md:141-145SKILL.md:200-204
User-Provided Remote URLs May Be Fetched
The skill tells agents to download remote image URLs with curl before processing. Without validation guidance, this could fetch unintended internal, private, or untrusted resources from the execution environment.
The remote URL workflow is clearly documented, but no implementation is bundled. The risk depends on how the agent validates URLs before running curl.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
SKILL.md:33-35SKILL.md:85-88SKILL.md:105-106SKILL.md:171
External Command Alerts Are Mostly Documentation Examples
The static Ruby backtick detections map to fenced command examples and Markdown instructions, not bundled executable code. The skill still asks agents to use curl, so command execution should be user-visible and limited to the documented workflow.
The reviewed file is Markdown and contains no separate script file. Some command execution remains intentional because the instructions tell the agent to call curl.
Low
SKILL.md:3SKILL.md:26SKILL.md:39SKILL.md:48
Weak Cryptography Alerts Are False Positives
The reported weak-cryptography locations contain descriptive Markdown, tables, or skill metadata. No evidence of MD5, SHA1, DES, RC4, or other cryptographic implementation was found in the reviewed skill file.
The cited lines contain no cryptographic code or algorithm selection. This is a strong false positive from keyword matching in prose.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable