T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/extract_pdf.py:514- Finding
Automatic External Transmission of PDF Page Content Without Invocation-Level Consent
- Content
View full analysis
env var > skill config.json > hardcoded default DEFAULT_OCR_API_KEY = os.environ.get("OCR_API_KEY", os.environ.get("OPENROUTER_API_KEY", _skill_cfg[0])) DEFAULT_OCR_BASE_URL = os.environ.get("OCR_BASE_URL", _skill_cfg[1] or "https://openrouter.ai/api/v1") DEFAULT_OCR_MODEL = os.environ.get("OCR_MODEL", _skill_cfg[2] or "qwen/qwen3.6-plus:free") ``` ```python def ocr_pdf_pages(pdf_path: str, page_nums: list, dpi: int = 200, api_key: str = None, base_url: str = None, model: str = None) -> dict[int, str]: """OCR specific pages of a PDF using the configured vision model.""" if not HAS_OCR: print(" Warning: OCR dependencies missing. Install: python -m pip install pymupdf openai") return {} api_key = api_key or DEFAULT_OCR_API_KEY base_url = base_url or DEFAULT_OCR_BASE_URL model = model or DEFAULT_OCR_MODEL # Auto-detect vision support and fallback if needed if not _is_vision_model(model): print(f" Warning: Model '{model}' may not support vision; falling back to default vision model.") model = "qwen/qwen3.6-plus:free" if not api_key: print(" Error: No API key. OCR skipped. Set OCR_API_KEY or use --ocr-api-key.") return {} client = OpenAI(api_key=api_key, base_url=base_url) doc = fitz.open(pdf_path) ocr_prompt = ( "Extract ALL visible text from this PDF page image. " "Preserve layout, tables, numbers exactly. Return ONLY the text." ) results = {} for pg_num in page_nums: try: page = doc[pg_num - 1] zoom = dpi / 72 pix = page.get_pixmap(matrix=fitz.Matrix( ...[truncated 5240 chars]- Remediation
View remediation