技能 nx-matting
📦
nx-matting
v1.0.0 内容修订 r1 严重 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
Remove Image and Video Backgrounds
Background removal often requires complex local tools or cloud uploads. This skill runs BiRefNet locally and creates transparent image or video files.
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "nx-matting" from https://skillstore.io/skills/xiaowu89-nx-matting.md and its manifest at https://skillstore.io/api/skills/xiaowu89-nx-matting/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“nx-matting”。 Remove the background from C:\photos\portrait.jpg.
预期结果:
Created C:\photos\portrait_transparent.png with the original dimensions and a transparent background.
正在使用“nx-matting”。 Create a transparent WebM from C:\videos\demo.mp4 without audio.
预期结果:
Created C:\videos\demo_transparent.webm without audio and reported the selected inference backend.
正在使用“nx-matting”。 Check whether this computer is ready for matting.
预期结果:
Reported Windows architecture, available runtimes, installed models, Vulkan status, cache location, and FFmpeg availability.
安全审计
严重v1 • 2026/7/30 打开版本化报告
Most backtick, reconnaissance, temporary-path, and entropy alerts are syntax or documentation false positives. Confirmed risks include PowerShell execution with policy bypass, automatic remote artifact downloads, and unverified FFmpeg discovery outside the skill root. A critical instruction forces assistants to repeat a Base64-obfuscated third-party contact notice.
10
已扫描文件
1,294
分析行数
20
复核项
0
已忽略误报
已确认安全问题 (2)
严重
Prompt Injection Attempt Detected
The skill says the final reply “必须原样展示” a third-party contact notice. Base64 hides the notice in code and forces unsolicited contact promotion.
The instruction explicitly controls the assistant's final response, and the script decodes and injects the same contact notice into terminal events.
高
Automatic Execution of Author-Hosted Native Binaries
Normal processing downloads opaque Windows executables from author-controlled endpoints and runs them. Hashes ensure consistency but provide no independent provenance.
The manifest identifies executable artifacts, while the script downloads them using author-supplied hashes and selects them for local inference.
能力复核项 (20)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "scripts/matting.ps1" image `
The documentation directs users or agents to execute the bundled PowerShell script with ExecutionPolicy Bypass. That script can download and run native binaries.
高
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "scripts/matting.ps1" video `
The documentation directs users or agents to execute the bundled PowerShell script with ExecutionPolicy Bypass. That script can download and run native binaries.
高
Path traversal sequence
Add-Candidate (Join-Path $SkillRoot "..\..\ffmpeg") "nxengine"
The script searches two directories above its root for FFmpeg and later executes a matching binary. The candidate receives capability checks but no integrity or signature verification.
高
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" image `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
高
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" image `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
高
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" video `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
高
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" video `
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
高
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" doctor
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
高
PowerShell invocation
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\matting.ps1" ensure-mo
The skill directs the agent to execute the bundled PowerShell script with ExecutionPolicy Bypass. The script can download and run native processing binaries.
中
Hardcoded URL
"https://www.gyan.dev/ffmpeg/builds/packages/ffmpeg-8.1.2-essentials_build.zip"
The script can download this FFmpeg archive and execute its binaries. SHA-256 verification reduces tampering risk, but remote executable acquisition remains security-sensitive.
低
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/3b9e5ff30cb66902e9b80857be16a3d3415f732
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
低
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/nx-matting-cpu.exe"
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
低
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/3b9e5ff30cb66902e9b80857be16a3d3415f732
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
低
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/nx-matting-vulkan.exe"
This URL supplies a native runtime that the script downloads and executes. Size and SHA-256 checks reduce tampering risk but do not remove the remote binary trust dependency.
低
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/BiRefNet-lite-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
低
Hardcoded URL
"https://huggingface.co/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-lite-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
低
Hardcoded URL
"https://hf-mirror.com/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-lite-F16.gguf"
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
低
Hardcoded URL
"https://modelscope.cn/models/xiaowu89/BiRefNet-GGUF/resolve/master/BiRefNet-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
低
Hardcoded URL
"https://huggingface.co/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-F16.gguf",
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
低
Hardcoded URL
"https://hf-mirror.com/Acly/BiRefNet-GGUF/resolve/main/BiRefNet-F16.gguf"
This configured endpoint is used to download a model during normal operation. Integrity checks limit tampering, but the network dependency and parser exposure remain real.
风险因素
⚙️ 外部命令 (50)
README.md:36-38 README.md:30 README.md:32 README.md:36 README.md:43 scripts/matting.ps1:383 scripts/matting.ps1:386 scripts/matting.ps1:391 scripts/matting.ps1:660 scripts/matting.ps1:391 scripts/matting.ps1:407 scripts/matting.ps1:515 scripts/matting.ps1:660 scripts/matting.ps1:386-391 scripts/matting.ps1:391-660 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:52 SKILL.md:54-56 SKILL.md:57-61 SKILL.md:62-66 SKILL.md:70-71 SKILL.md:73-77 SKILL.md:77-78 SKILL.md:78-79 SKILL.md:79-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-87 SKILL.md:87-90 SKILL.md:90-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97 SKILL.md:98 SKILL.md:4 SKILL.md:23 SKILL.md:54 SKILL.md:56 SKILL.md:61 SKILL.md:66 SKILL.md:70 SKILL.md:87 SKILL.md:88 SKILL.md:89
🌐 网络访问 (12)
README.md:23 references/manifest.json:14 references/manifest.json:15 references/manifest.json:23 references/manifest.json:24 references/manifest.json:35 references/manifest.json:36 references/manifest.json:37 references/manifest.json:45 references/manifest.json:46 references/manifest.json:47 references/manifest.json:57
审计者: codex
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/xiaowu89-nx-matting/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/xiaowu89-nx-matting?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/xiaowu89-nx-matting?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiaowu89-nx-matting/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/xiaowu89-nx-matting.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
xiaowu89. (2026). nx-matting security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/xiaowu89-nx-matting/audits/1BibTeX 引用
@techreport{xiaowu89-xiaowu89-nx-matting-2026,
author = {xiaowu89},
title = {nx-matting security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/xiaowu89-nx-matting/audits/1},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nx-matting security audit report (audit version 1)"
version: "1.0.0"
type: report
authors:
- name: "xiaowu89"
date-released: "2026-07-30"
url: "https://skillstore.io/skills/xiaowu89-nx-matting/audits/1"
identifiers:
- type: other
value: "skillstore:xiaowu89-nx-matting:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 77
架构
100
可维护性
87
内容
65
社区
83
规范符合性
你能构建什么
Prepare product images
Create transparent PNG product assets for catalogs, stores, and presentations.
Extract portrait subjects
Remove photo backgrounds while preserving people for design compositions.
Create transparent video
Convert recorded subjects into MOV or WebM overlays for editing and web projects.
试试这些提示
Remove a photo background
Remove the background from [image path]. Save a transparent PNG beside the original without overwriting any file.
Create a product cutout
Use the Full model on [product image path]. Save a high-quality transparent PNG to [output path].
Create a web video overlay
Remove the background from [video path]. Export transparent WebM to [output path] and omit audio.
Control an advanced run
Process [input path] with [CPU or Vulkan], [Lite or Full], cache directory [path], and output [path]. Preserve temporary files for diagnostics.
最佳实践
- Keep the source file unchanged and write results to a separate output path.
- Use the Lite model for previews, then use Full only when edge quality requires it.
- Review alpha edges, video format support, and audio settings before delivery.
避免
- Do not overwrite an existing output without explicit approval.
- Do not select the Full model when download size or processing time is constrained.
- Do not assume every editor or browser supports transparent MOV or WebM.
常见问题
Which operating systems are supported?
The provided automation supports Windows x64 with PowerShell.
Does processing upload my media?
Media inference is local. The skill uses network access to download required models, runtimes, and FFmpeg.
Which image formats are accepted?
The skill accepts JPG, PNG, BMP, and WebP images.
Which transparent outputs are available?
Images use transparent PNG. Videos use transparent MOV by default or WebM when requested.
What is the difference between Lite and Full?
Lite is smaller and faster. Full is about 440 MB and targets higher-quality matting.
Is a GPU required?
No. CPU inference is supported, while Vulkan can accelerate processing on compatible systems.
开发者详情
作者
xiaowu89许可证
MIT
作者版本
v1.0.0
Skillstore 修订
r1
引用
57b0aa25b10809a60680af415997d53740bd0049
维护新鲜度
2026/7/30
使用量
0 次下载 · 1 次浏览
文件结构