Security audit

document-ocr-agent

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate remote OCR skill, but it can send very sensitive documents to third-party processing with weak consent and privacy guidance.

Install only if you are comfortable sending submitted documents and extracted contents to AgentPMT/Google Document AI. Require explicit user approval before processing IDs, tax forms, bank statements, medical/legal records, or other sensitive documents, use exactly one input source per request, and keep include_raw_document off unless the full raw OCR response is truly needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Low

Confidence: 94% confidence
Finding: The example MCP/REST call includes `content_base64`, `file_ids`, and `file_urls` simultaneously, directly contradicting the skill's own rule that exactly one input source must be provided. This can cause agents to construct invalid requests, trigger retries or fallback behavior, and accidentally send sensitive document content to the remote service through unintended channels.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation keywords are broad and generic (`process document`, `document type`, OCR-related phrases), which increases the chance that an agent auto-selects this skill for loosely related tasks. In this skill's context, mistaken invocation is more dangerous because it can result in users' local or sensitive documents being uploaded to a third-party OCR backend without deliberate confirmation.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill encourages processing receipts, IDs, tax forms, bank statements, and other highly sensitive documents, but it does not clearly warn that those files and extracted contents are transmitted to a remote AgentPMT/Google Document AI service. This omission can mislead users and upstream agents about privacy boundaries, increasing the risk of unconsented disclosure of PII, financial data, and regulated records.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The schema instructs callers to send full document contents to Google Document AI but does not warn that uploaded files may contain sensitive personal, financial, or identity data. In an OCR skill context, users are especially likely to submit invoices, passports, W-2s, and bank statements, so omission of privacy and third-party processing disclosure increases the risk of inadvertent sensitive-data exposure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The `include_raw_document` option allows return of the full raw Document AI response, which can contain more sensitive extracted text, metadata, and structured fields than a caller may expect from a summarized OCR result. In this skill's context, that is more dangerous because supported document types include identity and financial records, so enabling raw responses without an explicit warning increases the chance of overexposure of PII and confidential document contents.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.