Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward image-analysis helper with no hidden code or persistence, though users should be careful with sensitive images.
Installers should treat this as a normal vision-analysis skill. Use it only on images you intend the agent to inspect, and be cautious with receipts, business cards, forms, screenshots, IDs, medical records, credentials, or confidential business documents; redact or limit extraction when full details are not needed.
The description is broadly scoped enough to trigger on many common image-related requests, which can cause over-invocation of the skill without clear user intent boundaries. While not directly enabling code execution or privilege escalation, this can expand unnecessary access to user-provided images and OCR tasks, increasing privacy and data-handling risk.
The skill explicitly supports OCR and structured extraction from receipts, business cards, forms, screenshots, and similar images, but provides no warning about handling sensitive personal, financial, or business information. This omission can normalize extraction of PII or confidential data without prompting caution, minimization, or consent checks, making accidental privacy violations more likely.
No suspicious patterns detected.
