文件OCR解析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:00 AM UTC
• Version: 1.0.1

Overview

The OCR skill is coherent, but it needs review because it runs a mutable npm CLI and may send sensitive documents or credentials through under-disclosed paths.

Install only if you are comfortable using Deli's CLI and external OCR service for the documents you provide. Prefer a pinned, reviewed CLI version, avoid placing API keys directly in shell commands, protect `~/.deli/cli/config.json`, and get explicit approval before sending contracts, IDs, receipts, court records, or other confidential files to OCR.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: references/cli-common.md:10

Finding

Mutable npm CLI Package Is Downloaded and Executed

Content

View full analysis

" npx @delilegal/deli-cli@latest cmds deli-ocr-file-parser@1.0.0 ``` Subsequent operations use the same mutable package reference: ```bash npx @delilegal/deli-cli@latest run_a1b2c3d4e5f6 parse-file --input "D:\case\contract-scan.pdf" --output-dir "D:\case\parsed" npx @delilegal/deli-cli@latest run_a1b2c3d4e5f6 image-ocr --input "D:\case\payment-receipt.png" --output-dir "D:\case\parsed" --lang "zh-cn+en" npx @delilegal/deli-cli@latest run_a1b2c3d4e5f6 pdf-to-markdown --input "D:\case\court-document-scan.pdf" --output-dir "D:\case\parsed" ``` The filenames above are English translations of the example filenames in the source documentation; the executable commands and package reference are unchanged. ### Technical Analysis The Skill requires `npx` to execute `@delilegal/deli-cli@latest`. The `latest` npm distribution tag is mutable and does not identify the exact package version that was reviewed. Depending on the local npm cache and configuration, `npx` can download the currently published package and execute its lifecycle or CLI code immediately. No exact version, package-lock integrity value, checksum, signature verification, or trusted artifact digest is required. Consequently, the effective executable payload may change after the Skill itself has passed review. This is an insecure supply-chain boundary. Compromise of the npm publisher account, registry resolution path, package dependencies, or a future package release could turn the mandatory prerequisite command into arbitrary local code execution. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry path, or an inclu ...[truncated 1138 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/cli-common.md:15

Finding

API Key Is Passed Through a Command-Line Argument

Content

View full analysis

" ``` The placeholder is translated into English from the source documentation; the command structure is unchanged. ### Technical Analysis The initialization procedure instructs users to place the API key directly in a command-line argument. Command-line secrets may be exposed through: - Interactive shell history. - Process argument inspection while the command is running. - Terminal session recording. - CI/CD or Agent command logs. - Diagnostic and audit telemetry. - Error reports that capture the executed command. Quoting the value protects shell parsing but does not prevent these disclosure channels. The documentation states that the resulting configuration is stored under `~/.deli/cli/config.json`, but it does not document file-permission enforcement or secure secret-store integration. ### Attack Path 1. A user obtains a valid Deli API key. 2. The user follows the documented `init --apikey "..."` command. 3. The shell, Agent runtime, process monitor, or logging system records the full argument. 4. A local user or log reader obtains the API key. 5. The exposed key is used to access Deli services within the permissions and quota assigned to the credential. ### Impact Assessment An attacker who obtains the API key may impersonate the authorized user to the extent permitted by that key. Potential impact includes: - Unauthorized API requests. - Consumption of service quotas or billable usage. - Access to capabilities associated with the credential. - Attribution of attacker activity to the legitimate account. This issue does not independently grant operating-system privileges. Its scope is primarily the external service authorization represented by the exposed key. ]]>

Remediation

View remediation

other

Warning

• Location: SKILL.md:37

Finding

Sensitive Documents May Be Transferred to an External OCR Backend Without an Explicit Consent Gate

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs use of npx @delilegal/deli-cli@latest, which fetches and executes the newest published package version at runtime rather than a reviewed, fixed version. That creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, users of the skill may execute untrusted code during authentication and OCR workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions tell the user to pass an API key directly on the command line and store it in ~/.deli/cli/config.json without warning about shell history, process-list exposure, file permissions, or local secret handling. This increases the chance of credential leakage to other local users, logging systems, terminal history, or insecurely protected configuration files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This second invocation also relies on npx @delilegal/deli-cli@latest, so the same unpinned runtime execution risk applies when discovering commands. Because the command output controls subsequent execution flow (RUN id, usage, commands, params), a compromised package could influence both code execution and downstream tool selection.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The guide invokes npx @delilegal/deli-cli@latest, which fetches and executes the latest published package at runtime rather than a fixed, reviewed version. If the package, dependency chain, or publishing account is compromised, users may execute attacker-controlled code on their local machine while processing sensitive legal documents.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This example again instructs users to run npx ...@latest, creating a supply-chain execution path every time the OCR workflow is used. In the context of OCR over contracts, court filings, receipts, and IDs, compromise could expose highly sensitive files or execute arbitrary code with the user's permissions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The sample command normalizes runtime execution of an unpinned package version, which is dangerous because npx may download and execute new code without review. Since this skill is specifically for files the platform cannot parse natively, it is likely to be used on sensitive edge-case documents, increasing the damage from supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This is another instance of instructing execution of a latest-version CLI package, which creates avoidable remote code execution and dependency substitution risk. Repetition across examples makes unsafe usage more likely to be copied verbatim by downstream agents or operators.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide recommends sending local documents and images to an OCR CLI but does not explicitly warn that content may be uploaded to a remote service or otherwise leave the local environment. For legal, financial, identity, and court materials, lack of informed consent and handling guidance can lead to unintended disclosure of regulated or highly confidential data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guide encourages saving OCR outputs and raw responses, but it does not warn that these artifacts may persist sensitive personal, financial, or legal data on disk in accessible locations. This can create secondary exposure through shared workstations, backups, sync tools, endpoint compromise, or accidental reuse by later workflows.

Content

No source excerpt is available for this finding.