poocr vatinvoice2excel

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:12 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Chinese invoice OCR helper, but users should understand it sends invoice data to Tencent Cloud and installs an unpinned Python package.

Before installing, confirm that your organization permits sending invoice contents to Tencent Cloud, use least-privilege Tencent Cloud API credentials, avoid putting real keys directly in shared code, and install poocr in a virtual environment with a pinned reviewed version when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–23
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

pip install poocr

Technical Analysis

The skill directs users to install poocr from the package index configured for pip without specifying a reviewed version, verifying cryptographic hashes, using a lockfile, or documenting a trusted source. Consequently, the package and its transitive dependencies may change independently of the reviewed skill.

Python package installation can execute package-controlled build or installation logic. If the package publisher, distribution account, package index, or a transitive dependency is compromised, following this instruction could execute attacker-controlled code. The risk may also increase when an untrusted or incorrectly configured package index is in use.

This finding establishes an unsafe dependency-management practice; it does not establish that the current poocr release is malicious.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or the package distribution channel and publishes a malicious release.
2. A user follows the skill's unpinned pip install poocr instruction.
3. pip resolves the attacker-controlled release because no version or hash is enforced.
4. Malicious package code executes during installation, import, or OCR processing.
5. The code accesses resources available to the process, potentially including invoice files and Tencent Cloud credentials supplied later by the user.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip or the Python process. The accessible scope may include local documents, invoice data, environment variables, cloud API credentials, output files, and network resources available to that account. Installation with e ...[truncated 66 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin poocr and every transitive dependency to versions that have been reviewed and tested.
2. Store dependencies in a lockfile or requirements file containing cryptographic hashes, and install with hash enforcement:

   bash

   pip install --require-hashes -r requirements.txt
   

3. Document the package's verified publisher, official repository, and expected package index.
4. Use an explicitly configured trusted index rather than relying on ambient pip configuration.
5. Review package source and release artifacts before approving upgrades, and use automated dependency and provenance scanning.
6. Install and run the package in an isolated virtual environment or restricted container under a non-privileged account.
7. Provide Tencent Cloud credentials with the minimum permissions required, avoid embedding them in source code, and rotate them if package compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly relies on Tencent Cloud OCR to process invoice files, which means invoice contents are transmitted to a third-party service. Invoices commonly contain sensitive personal, financial, and business data, and the documentation does not warn users about data disclosure, retention, compliance, or consent considerations before upload.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language description and usage instructions are entirely in Chinese, which can amount to forcing a specific language experience if the organizational policy requires language choice or opt-in. The file does not state that the skill is China-specific or offer users an alternative language.

Content

No source excerpt is available for this finding.