Security audit

保险责任分析

Security checks for vulnerabilities and agentic risk

Overview

The skill’s insurance-analysis purpose is coherent, but it can automatically install Python packages from the network and modify the user’s environment during normal use.

Review before installing. Use only in an isolated environment, avoid feeding highly sensitive policyholder data unless you accept the local processing and package-install behavior, and prefer preinstalling reviewed, pinned dependencies instead of allowing the scripts to run pip automatically.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (10)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: except ImportError: print("[提示] paddleocr 未安装。正在尝试安装...", file=sys.stderr) import subprocess subprocess.check_call( [sys.executable, "-m", "pip", "install", "paddleocr>=2.7", "paddlepaddle>=2.6", "-i", "https://pypi.tuna.tsinghua.edu.cn/simple/",
Confidence: 96% confidence
Finding: The script automatically invokes pip to download and install OCR packages from a third-party mirror at runtime when imports fail. This expands a local OCR helper into network-enabled code execution and supply-chain risk: a compromised mirror, dependency, or package resolution could result in arbitrary code running in the user's environment.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: except ImportError: print("[提示] pytesseract 未安装。正在尝试安装...", file=sys.stderr) import subprocess subprocess.check_call( [sys.executable, "-m", "pip", "install", "pytesseract", "Pillow", "-i", "https://pypi.tuna.tsinghua.edu.cn/simple/",
Confidence: 96% confidence
Finding: The Tesseract fallback path also performs automatic pip installation from the network, again turning simple OCR processing into remote code retrieval and execution. Because pip package installation executes package build/install logic, this creates a meaningful supply-chain compromise path if the repository or dependency chain is malicious or tampered with.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: "-i", "https://pypi.tuna.tsinghua.edu.cn/simple/", "--trusted-host", "pypi.tuna.tsinghua.edu.cn"] if install_cmd: subprocess.check_call( [sys.executable] + install_cmd[1:], stdout=sys.stderr, stderr=sys.stderr) return scrape_with_requests(url)
Confidence: 94% confidence
Finding: The script invokes pip through subprocess at runtime to install missing dependencies, which adds code-execution and package-management behavior to a scraper that should only fetch and parse text. This is dangerous because it can modify the host environment unexpectedly and may execute unreviewed package installation logic from an external index, especially in automated agent environments where users did not consent to dependency changes.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: For an OCR utility, fetching and installing code from the network at runtime exceeds the expected scope and introduces unnecessary attack surface. In this skill context, users are likely uploading sensitive insurance documents, so silently adding network package retrieval increases trust and confidentiality concerns alongside supply-chain execution risk.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The fallback logic performs the same unjustified runtime network installation behavior, which is not necessary for the core purpose of reading local images. This is especially concerning in an insurance-analysis skill because users may reasonably expect purely local processing of sensitive policy images, not dependency fetching and code execution.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: Auto-installing Python packages during normal scraping expands the skill's capabilities beyond insurance-text extraction into environment modification and indirect code execution. In an agent skill context, this is more dangerous because the tool may run unattended on shared hosts or CI-like environments, so a simple scrape request can trigger package installation from the network without explicit approval.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill fetches arbitrary URLs and generates HTML reports from untrusted insurance text, but it does not present clear safety warnings or consent boundaries to users. This increases the chance of unsafe remote fetches, collection of sensitive policy data, and rendering of unsanitized content, especially because insurance documents often contain personal information.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script gives no clear upfront warning in its CLI help or main flow that running it may trigger package installation and network access. This reduces informed consent and can surprise users into executing code-fetching behavior they did not authorize, which is dangerous when handling sensitive documents or running in restricted environments.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The fallback package-install path similarly lacks clear prior disclosure, so users may unknowingly trigger network access and package installation simply by invoking OCR. This is a security-relevant behavior change because package installation is code execution, not a harmless convenience feature.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script performs package installation via subprocess without disclosing that behavior in its CLI help or normal usage contract, so operators may unknowingly allow environment-changing actions. While this is partly a transparency issue, hidden installation behavior is security-relevant because it undermines informed consent and makes automated execution less predictable and easier to abuse operationally.

Static analysis

No suspicious patterns detected.