Security audit

试卷OCR重建助手

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to perform its stated exam OCR and report-generation workflow, with privacy considerations for external OCR and LLM processing.

Install only if you are comfortable processing the exam files through the selected OCR and LLM services. For confidential, copyrighted, or student-identifying materials, prefer local OCR where possible, avoid optional online document creation unless needed, and use a dedicated output folder for generated files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs generation of local output files such as HTML, JSON, and Markdown and references helper scripts, but it does not declare corresponding permissions or clearly constrain write locations. Undeclared file-write capability weakens user and platform visibility into what the skill can persist, which can enable unintended overwrites, storage of sensitive exam/OCR data, or abuse if the skill is invoked unexpectedly.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 78% confidence
Finding: The skill description omits additional behavior such as direct text extraction from text-based PDFs and PDF type classification, creating a description-behavior mismatch. When a skill processes documents in ways not disclosed to the user, it can expand data access and handling beyond informed expectations, especially for potentially sensitive exam materials.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README states that OCR may use the tencent-docs connector but does not clearly disclose that uploaded exam PDFs or images could be sent to an external third-party service. This creates a real data-handling and privacy risk because exam materials may contain copyrighted content, student data, or other sensitive information, and users are not given enough notice to make an informed decision.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill handles uploaded exam PDFs/images and explicitly sends content to external Tencent Docs OCR services and to an LLM for audit, but the description lacks a clear user warning about this third-party data transfer. This is dangerous because exam papers may contain copyrighted, confidential, or personal information, and undisclosed external processing can cause privacy, compliance, and data-governance violations.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list includes broad phrases like '试卷录入' and 'exam OCR', which can cause the skill to activate in contexts broader than the user intended. Because the skill may upload documents to external services and write output files, accidental invocation increases the chance of unintended data disclosure or processing of sensitive materials.

Static analysis

No suspicious patterns detected.