Security audit

CamScanner-Image2Markdown

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed CamScanner image-to-Markdown integration, but its instructions can upload any image-bearing user request to a third-party service without an explicit consent step.

Review this before installing if you handle private screenshots, IDs, financial records, source code, health information, or business documents. Use it only when you intend to send the image to CamScanner for OCR, and consider redacting or cropping sensitive regions first.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

Location: SKILL.md:3
Finding: Automatic Third-Party Disclosure of User-Provided Images Without Explicit Consent
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 3 and 25-34
Vulnerability Type: Unauthorized third-party data disclosure
Risk Level: Medium

Vulnerable Instructions

yaml
description: Use CamScanner to convert images to Markdown format, powered by a high-precision document parsing engine that intelligently decomposes paragraphs, precisely recognizes tables and multiple element types, handles complex image scenarios, and outputs structured results in reading order, empowering large language models to accurately understand document content. Use when the user wants to convert images (PNG, JPG, etc.) to Markdown, or when images contain text, tables, code, or structured content that needs to be extracted. Also use when the user's input contains images - convert to Markdown first to better understand the image before responding.

markdown
## When to Use - User wants to convert an image to Markdown - User wants to extract text/content from an image as Markdown (OCR) - User has a screenshot or photo with text, tables, or structured content - **User's input contains images** — convert to Markdown first, then use the extracted text to better understand and respond to the user's request ## Privacy & Data > **Important: Privacy & Data Flow Notice** > > - **Third-party service**: This skill sends your files to CamScanner's official servers (`ai-tools.camscanner.com`) for processing.

Technical Analysis

The skill directs the agent to invoke CamScanner whenever an input contains an image, including when the user has not explicitly requested OCR or conversion. Invocation uploads the image to the external domain ai-tools.camscanner.com.

Although the document contains a privacy notice, it does not require the agent to present that notice to the user or obtain affirmative consent before transmission. Merely attaching an image does not establish informed consent to disclose ...[truncated 2176 chars]
Remediation: View remediation
Remediation Suggestions

Replace automatic processing with an explicit consent requirement. Before upload, identify CamScanner as the recipient, explain that the complete image will leave the current environment, and ask the user to approve the transfer.

Limit automatic skill selection to requests that explicitly ask for OCR, image-to-Markdown conversion, or CamScanner processing. Remove the instruction to process every image automatically.

Provide a local OCR option where available, particularly for confidential or regulated content.

Add a sensitivity check before upload. Refuse or request additional confirmation when an image appears to contain credentials, identity documents, health information, financial data, private keys, or proprietary records.

Apply data minimization by allowing the user to crop or redact the image and upload only the region necessary for the requested task.

Make the privacy notice actionable rather than informational. Record affirmative opt-in per upload or clearly defined batch instead of treating skill invocation as consent.

Document the third party's retention, transport security, processing locations, subprocessors, and deletion guarantees, and avoid making retention assurances unless they are contractually and technically verified.

Validate that upload, conversion, and download operations use only the declared HTTPS origin and fail closed on redirects or unexpected endpoints.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill metadata explicitly says it should be used not only on explicit OCR requests but also whenever the user's input contains images. That broad trigger can cause automatic transmission of image content to a third-party service without sufficiently clear user intent or tight scope limits, increasing the chance of sending sensitive screenshots, documents, or personal data off-platform.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The usage guidance says to convert images to Markdown first to better understand and respond, but it does not define boundaries for when that preprocessing is unnecessary or inappropriate. In practice, this encourages over-collection and third-party processing of image content even when a simpler local or direct response path would suffice.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This step uploads the raw image file to an external domain, creating a direct data exfiltration path from the local environment to a third-party service. Because images may contain credentials, IDs, financial records, or other sensitive material, automatic or insufficiently gated upload creates meaningful confidentiality risk.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
bash
BASE="https://ai-tools.camscanner.com" IN_FILE_ID=$(curl -sS -X POST "$BASE/v1/tools/upload_file/execute" \ -H "Content-Type: application/octet-stream" \ --data-binary "@/path/to/image.png" | jq -r '.tool_result.data.file_id')

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
Step 2: Convert Image to Markdown

bash
OUT_FILE_ID=$(curl -sS -X POST "$BASE/v1/tools/convert_image/execute" \ -H "Content-Type: application/json" \ -d "{\"file_id\":\"$IN_FILE_ID\",\"source_type\":\"image\",\"target_type\":\"md\",\"output_mode\":\"file_id\"}" \ | jq -r '.tool_result.data.file_id')

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
Step 2: Convert Image to Markdown

bash
OUT_FILE_ID=$(curl -sS -X POST "$BASE/v1/tools/convert_image/execute" \ -H "Content-Type: application/json" \ -d "{\"file_id\":\"$IN_FILE_ID\",\"source_type\":\"image\",\"target_type\":\"md\",\"output_mode\":\"file_id\"}" \ | jq -r '.tool_result.data.file_id')

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
Step 3: Download Result

bash
curl -sS -X POST "$BASE/v1/tools/download_file/execute?response_mode=raw" \ -H "Content-Type: application/json" \ -d "{\"file_id\":\"$OUT_FILE_ID\"}" \ -o /path/to/output.md

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
| jq -r '.tool_result.data.file_id') # Download curl -sS -X POST "$BASE/v1/tools/download_file/execute?response_mode=raw" \ -H "Content-Type: application/json" \ -d "{\"file_id\":\"$OUT_FILE_ID\"}" \ -o "$OUTPUT_FILE"

Overview

A.I.G

other

Vulnerability Details

Vulnerable Instructions

Technical Analysis

Remediation Suggestions

SkillSpector

Vague Triggers

Vague Triggers

External Transmission

External Transmission

Step 2: Convert Image to Markdown

External Transmission

Step 2: Convert Image to Markdown

External Transmission

Step 3: Download Result

External Transmission