Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed CamScanner image-enhancement workflow that uploads a chosen image to CamScanner, processes it, and downloads the result.
Install only if you are comfortable sending selected images or scanned documents to CamScanner's servers for processing. Avoid using it on sensitive IDs, financial records, medical documents, or confidential business files unless that external processing is acceptable to you.
The trigger description is broad enough to match many ordinary image-editing requests such as making an image clearer, sharper, or higher quality. Overly broad activation increases the chance this skill is invoked unexpectedly and causes users' images to be sent to a third-party service without sufficiently specific intent, which is a privacy and consent risk.
This step uploads a local image file to an external CamScanner endpoint, creating an explicit data exfiltration path from the local environment to a third party. Even if the service is legitimate and the privacy notice is present, transmitting potentially sensitive documents or photos off-device introduces confidentiality, compliance, and consent risks.
BASE="https://ai-tools.camscanner.com"
IN_FILE_ID=$(curl -sS -X POST "$BASE/v1/tools/upload_file/execute" \
-H "Content-Type: application/octet-stream" \
--data-binary "@/path/to/image.png" | jq -r '.tool_result.data.file_id')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Default mode (super filter):
OUT_FILE_ID=$(curl -sS -X POST "$BASE/v1/tools/image_hd/execute" \
-H "Content-Type: application/json" \
-d "{\"file_id\":\"$IN_FILE_ID\"}" \
| jq -r '.tool_result.data.file_id')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Default mode (super filter):
OUT_FILE_ID=$(curl -sS -X POST "$BASE/v1/tools/image_hd/execute" \
-H "Content-Type: application/json" \
-d "{\"file_id\":\"$IN_FILE_ID\"}" \
| jq -r '.tool_result.data.file_id')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Default mode (super filter):
OUT_FILE_ID=$(curl -sS -X POST "$BASE/v1/tools/image_hd/execute" \
-H "Content-Type: application/json" \
-d "{\"file_id\":\"$IN_FILE_ID\"}" \
| jq -r '.tool_result.data.file_id')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -X POST "$BASE/v1/tools/download_file/execute?response_mode=raw" \
-H "Content-Type: application/json" \
-d "{\"file_id\":\"$OUT_FILE_ID\"}" \
-o /path/to/image_hd.jpg
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| jq -r '.tool_result.data.file_id')
# Download
curl -sS -X POST "$BASE/v1/tools/download_file/execute?response_mode=raw" \
-H "Content-Type: application/json" \
-d "{\"file_id\":\"$OUT_FILE_ID\"}" \
-o "$OUTPUT_FILE"
No suspicious patterns detected.