ClawHub
Back to skill

Security audit

文件OCR解析

Security checks across malware telemetry and agentic risk

Overview

This skill is a purpose-aligned OCR helper that uses a third-party CLI only when native parsing fails or the user asks for OCR.

Before installing, be comfortable with using Delilegal's OCR CLI for files that native parsing cannot handle. Treat the API key in ~/.deli/cli/config.json as sensitive, and avoid sending documents to OCR unless you approve that external processing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This markdown file instructs the workflow to initialize the CLI with an API key and notes the local storage path, but it does not explicitly warn the user that their credential will be persisted on disk. Because API keys are sensitive credentials, the skill description should clearly disclose the storage behavior and associated sensitivity before proceeding.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.