Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed cloud OCR client for consented KYC document images, with sensitive data handling risks that are expected for its purpose.
Install only if you have authorization to process the documents, have configured a trusted HTTPS eKYC backend, and have appropriate masking, access control, retention, and human-review procedures for identity and bank-card data.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
payload = {"image": media_input(image)}
if side is not None:
payload["side"] = side
response = requests.post(
f"{endpoint}/api/v1/tools/{tool}",
json=payload,
headers=headers,
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# Changelog
## 1.0.17 - 2026-08-17
Without declared permissions the skill's intent is opaque and cannot be validated.
The file presents the skill in Chinese while also using English headings and descriptions, but it does not state that the language is region-specific or provide an opt-in/choice for users. Under the policy rule, forcing a specific language or locale without user choice can be a natural-language policy violation.
The default prompt contains many overlapping trigger phrases for document OCR and verification without tight routing boundaries, which can cause the agent to invoke this skill in situations beyond its intended scope. Because the skill handles sensitive identity documents in KYC workflows, over-broad invocation increases the risk of unnecessary processing of personal data, misuse on unsupported inputs, or accidental use in higher-stakes decisions.
The skill transmits extra environment-derived metadata such as client, workspace, install, and source identifiers in addition to the document image. For an OCR skill handling highly sensitive identity documents, this broadens data disclosure beyond the narrowly stated OCR purpose and can unnecessarily expose tenancy or user-context information to the remote service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload = {"image": media_input(image)}
if side is not None:
payload["side"] = side
response = requests.post(
f"{endpoint}/api/v1/tools/{tool}",
json=payload,
headers=headers,
Detected: suspicious.potential_exfiltration