ClawHub
Back to skill

Security audit

CamScanner Erase Handwriting

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed CamScanner workflow that uploads a user-chosen image for handwriting removal and saves the processed result locally.

Install only if you are comfortable sending chosen images to CamScanner for processing. Avoid using it on IDs, financial records, medical/legal documents, signatures, or other sensitive material unless CamScanner's current privacy and retention practices are acceptable for your use case.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
BASE="https://ai-tools.camscanner.com"

IN_FILE_ID=$(curl -sS -X POST "$BASE/v1/tools/upload_file/execute" \
  -H "Content-Type: application/octet-stream" \
  --data-binary "@/path/to/image.jpg" | jq -r '.tool_result.data.file_id')
```
Confidence
98% confidence
Finding
This step uploads a local image file to a third-party server, which is an actual external data transmission of potentially sensitive document contents. Although the skill discloses this behavior, it still creates privacy and data-handling risk because users may send IDs, forms, signatures, or other confidential material off-device.

Static analysis

No suspicious patterns detected.