PaddleOCR OCR & Document Parsing Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 1.0.2

Overview

This setup skill is not overtly malicious, but it asks an agent to globally install mutable, unpinned OCR skills, so users should review the install step before allowing it.

Only install this if you intentionally want a global PaddleOCR skill setup. Before approving the command, verify the repository and installer version, prefer pinned versions or explicit skill names instead of the wildcard, and treat any request to provide PaddleOCR tokens carefully; the skill correctly says not to print or store tokens in chat, logs, command history, or source files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Package and Mutable Repository Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–43
Vulnerability Type: Unpinned supply-chain dependencies and mutable global installation
Risk Level: Medium

markdown

2. Check Node.js/npx, Python 3.9+, and `uv`. Explain any missing prerequisite
   before using its official installer. Do not use `sudo` or change unrelated
   system settings without permission.
3. Run:

   ```bash
   npx skills add Aidenwu0209/PaddleOCR-Skills --skill '*' -g -y
   ```

4. Run `npx skills list -g --json` and confirm both
   `paddleocr-text-recognition` and `paddleocr-doc-parsing`, including their
   actual install paths.

Technical Analysis

The installation command invokes the skills npm package through npx without specifying an exact, verified package version. It also identifies the GitHub repository only by owner and repository name, without pinning installation to an immutable commit hash or verified release. The wildcard argument --skill '*' installs every skill present in the repository rather than limiting installation to the two documented OCR skills.

These mutable references mean that the components executed or installed in the future may differ from those reviewed during this audit. The -g option performs a user-global installation, while -y suppresses interactive confirmation by the underlying installation workflow. This creates a supply-chain risk if the npm package, repository, maintainer account, or distribution channel is compromised or if unexpected skills are later added. The reviewed project does not establish that any current dependency is malicious; the finding concerns the unsafe trust and versioning model.

Attack Path

1. An attacker compromises the unpinned npm package, the referenced GitHub repository, or a maintainer account.
2. The attacker publishes a modified CLI release, changes repository content, or adds another skill that contains attacker-controlled behavio ...[truncated 1362 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills npm CLI to an exact, reviewed version, for example by invoking a specific package version rather than allowing npx to resolve the latest release.
2. Pin Aidenwu0209/PaddleOCR-Skills to an immutable, reviewed commit hash or cryptographically verified release tag.
3. Replace --skill '*' with explicit installation of only paddleocr-text-recognition and paddleocr-doc-parsing.
4. Verify package integrity through lockfiles, published checksums, provenance attestations, or signatures where supported.
5. Avoid unconditional non-interactive installation. Present the exact package version, repository revision, selected skills, and destination paths for user confirmation before making a global change.
6. Prefer installation in a sandboxed or project-local environment when global availability is not essential.
7. Document a trusted-version update process that requires review of dependency and repository changes before advancing pinned versions.
8. After installation, verify that only the expected skill names and files were installed and report any unexpected additions as a failed installation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation guidance is broad enough to match many ordinary OCR-related requests, including cases where the user wants to perform OCR rather than install skills. This can cause the setup/installer skill to activate unexpectedly and steer the agent toward package installation and system-changing commands, increasing the chance of unnecessary execution of external tooling and confusing user intent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs the agent to execute npx skills add ... without pinning the skills package or otherwise constraining what code is fetched and run. Because npx may download and execute the latest package version at runtime, a compromised, typosquatted, or malicious upstream release could lead to arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.