ClawHub
Back to skill

Security audit

CamScanner-Image2Markdown

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but its instructions could send any image a user provides to CamScanner by default, even when the user did not explicitly ask for OCR.

Install only if users understand that images may be uploaded to CamScanner servers for processing. Use it for explicit OCR or image-to-Markdown tasks, and avoid applying it automatically to sensitive personal, legal, medical, financial, proprietary, or regulated images without clear user approval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill declares that it should be used whenever the user's input contains images, which is overly broad for a workflow that uploads user-provided files to a third-party service. This can cause sensitive screenshots, documents, IDs, or embedded private data to be transmitted off-platform without a narrowly scoped trigger or explicit user awareness at invocation time.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The repeated guidance to convert any image-containing input to Markdown first encourages indiscriminate processing of images through an external OCR provider. In context, this increases the chance of unnecessary disclosure of private or regulated data because the skill is positioned as a default preprocessing step rather than an explicitly requested action.

External Transmission

Medium
Category
Data Exfiltration
Content
--data-binary "@$INPUT_IMAGE" | jq -r '.tool_result.data.file_id')

# Convert
OUT_FILE_ID=$(curl -sS -X POST "$BASE/v1/tools/convert_image/execute" \
  -H "Content-Type: application/json" \
  -d "{\"file_id\":\"$IN_FILE_ID\",\"source_type\":\"image\",\"target_type\":\"md\",\"output_mode\":\"file_id\"}" \
  | jq -r '.tool_result.data.file_id')
Confidence
90% confidence
Finding
This step sends the uploaded image-derived file identifier to CamScanner's external conversion endpoint as part of a cloud OCR pipeline. While expected for the feature, it is still a real data egress path to a third-party service, and combined with the broad auto-triggering behavior it can expose sensitive image contents without sufficient minimization or consent.

Static analysis

No suspicious patterns detected.