Security audit
Security checks for vulnerabilities and agentic risk
ZenTable is a disclosed local table-rendering skill with OCR support for screenshot/photo table extraction, and the scanner concerns are mostly documentation or local-deployment false positives.
Install this only if you are comfortable running local Python/Chrome rendering code and, if using OCR, local Docker/FastAPI services. Review the pinned release scripts first, use a sandbox or container for sensitive data, and keep OCR endpoints bound to localhost or a private network unless you intentionally expose them.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
cd /var/www/html/zenTable/deploy/skill-fastapi
cp .env.example .env
docker compose up -d --build
Rendering structured table data into PNG images does not inherently require optical character recognition services or OCR-specific API endpoints. The deployment guide shows the skill stack includes OCR infrastructure, which is a materially different capability from visualization/rendering.
The manifest says this skill renders structured table data as PNG images using Headless Chrome. This deployment file documents a separate OCR service, OCR endpoints, and configurable OCR backends, indicating the skill includes optical character recognition capabilities not reflected in the manifest description.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
docker compose up -d --build
curl http://127.0.0.1:8001/health
The README materially expands the skill's apparent scope beyond the declared metadata by advertising OCR-assisted screenshot/photo extraction and TXT/ASCII workflows, while the manifest says the skill is for rendering structured table data as PNG images. This kind of capability mismatch is dangerous because users or orchestrators may invoke or trust the skill for data-ingestion tasks involving images or unstructured content that were not security-reviewed, increasing the chance of unintended data handling, over-privileged use, or hidden processing paths.
This markdown file contains natural-language text specifying 'English SKILL docs finalized for public distribution.' That can indicate an English-only language constraint without any mention of user choice, which may conflict with language/locale policy requirements when not justified or optional.
The deployment guide sets OCR_LANG=ch, which imposes a specific language/locale configuration in natural-language documentation. The file does not indicate that users may choose another language or that this constraint is required for a documented region-specific use case.
No suspicious patterns detected.