T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install_tesseract.py:73- Finding
Unverified Remote Executable Download and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
一个功能强大的屏幕浏览、OCR识别和屏幕分析技能包，专为AI助手设计
Security checks for vulnerabilities and agentic risk
Overview
This screen/OCR skill is coherent in purpose, but it captures and stores screen contents and includes an optional Windows installer that downloads and silently runs an unverified executable.
Review carefully before installing. Use the screenshot/OCR scripts only for intentional captures, avoid screens with passwords, messages, customer data, tokens, or payment information, and store outputs somewhere you can delete. Prefer manual, trusted Tesseract installation over running scripts/install_tesseract.py, or require pinned checksums/signature checks first. Do not run the packaging script from a directory containing generated captures, OCR text, logs, .env files, keys, or other private files.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/package_skill.py:112- Finding
Skill Packaging Can Include Screenshots, OCR Output, and Local Secrets
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (82)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as a screenshot/OCR utility but appears to execute shell commands to install packages and write local files, which are much more sensitive actions than passive image handling. This mismatch can cause an operator to authorize a data-viewing tool that actually modifies the environment, creating supply-chain and persistence risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a screenshot/OCR utility but appears to execute shell commands to install packages and write local files, which are much more sensitive actions than passive image handling. This mismatch can cause an operator to authorize a data-viewing tool that actually modifies the environment, creating supply-chain and persistence risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a screenshot/OCR utility but appears to execute shell commands to install packages and write local files, which are much more sensitive actions than passive image handling. This mismatch can cause an operator to authorize a data-viewing tool that actually modifies the environment, creating supply-chain and persistence risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The skill is presented as a screenshot/OCR utility but appears to execute shell commands to install packages and write local files, which are much more sensitive actions than passive image handling. This mismatch can cause an operator to authorize a data-viewing tool that actually modifies the environment, creating supply-chain and persistence risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a screenshot/OCR utility but appears to execute shell commands to install packages and write local files, which are much more sensitive actions than passive image handling. This mismatch can cause an operator to authorize a data-viewing tool that actually modifies the environment, creating supply-chain and persistence risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is presented as a screenshot/OCR utility but appears to execute shell commands to install packages and write local files, which are much more sensitive actions than passive image handling. This mismatch can cause an operator to authorize a data-viewing tool that actually modifies the environment, creating supply-chain and persistence risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a screenshot/OCR utility but appears to execute shell commands to install packages and write local files, which are much more sensitive actions than passive image handling. This mismatch can cause an operator to authorize a data-viewing tool that actually modifies the environment, creating supply-chain and persistence risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as a screenshot/OCR utility but appears to execute shell commands to install packages and write local files, which are much more sensitive actions than passive image handling. This mismatch can cause an operator to authorize a data-viewing tool that actually modifies the environment, creating supply-chain and persistence risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is presented as a screenshot/OCR utility but appears to execute shell commands to install packages and write local files, which are much more sensitive actions than passive image handling. This mismatch can cause an operator to authorize a data-viewing tool that actually modifies the environment, creating supply-chain and persistence risk.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation condition is overly broad, telling the agent to use this skill for essentially any request involving screenshots or viewing screen content. For a privacy-sensitive capability like screen capture, broad auto-selection increases the chance of unnecessary collection of secrets, personal data, or unrelated on-screen information.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
A screen-capture skill can easily collect passwords, messages, tokens, internal documents, and other sensitive data, yet the markdown lacks a clear privacy warning or handling guidance. In this context, omission of data-exposure warnings makes accidental overcollection and unsafe storage substantially more likely.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
Using shell=True for a simple version check is an avoidable tool-invocation weakness because execution is delegated to the shell and the binary is discovered via the current environment. In the context of a screen-capture/OCR skill, this increases risk because the skill may be installed on end-user systems with varying PATH contents, making local hijack or unintended binary execution more plausible.
- Content
python # 检查环境变量 try: result = subprocess.run( "tesseract --version", shell=True, capture_output=True,
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script downloads executable software and language data from the network at runtime without cryptographic pinning or strong provenance validation. This creates a software supply-chain risk: a compromised upstream host, redirected request, or tampered artifact could lead to installation of attacker-controlled code or data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code executes a freshly downloaded installer via the shell, turning a network retrieval into immediate code execution on the endpoint. In a screen viewer/OCR skill this is highly unjustified and creates a direct remote-to-local execution path if the download source is compromised or replaced.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Using shell=True to launch an installer is an unsafe execution pattern because shell metacharacter parsing can transform malformed or attacker-influenced strings into unintended commands. Here it compounds a more serious issue: the command targets a network-downloaded executable, so any compromise in the download chain can rapidly become host command execution.
- Content
python print("正在安装，请稍候...") # 运行安装程序 result = subprocess.run( install_command, shell=True, capture_output=True,
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python parser = argparse.ArgumentParser(description='技能打包工具') parser.add_argument('skill_dir', help='技能目录路径') parser.add_argument('-o', '--output', default='./dist', help='输出目录 (默认: ./dist)') parser.add_argument('--no-validate', action='store_true', help='跳过验证') parser.add_argument('--no-manifest', action='store_true', help='跳过清单创建') args = parser.parse_args()
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
This finding is the concrete tool-abuse manifestation of the subprocess pattern: shell=True allows shell metacharacter interpretation and expands the attack surface from a command invocation to full shell execution. In an installer script, that is especially dangerous because users commonly run setup with elevated trust, and any future parameterization could become arbitrary command execution.
- Content
python print(f"命令: {cmd}") try: result = subprocess.run( cmd, shell=True, capture_output=True,
exec() call detected
High
- Category
- Dangerous Code Execution
- Confidence
- 88% confidence
- Finding
Using exec() to run dynamically constructed Python code is dangerous because it executes in the current interpreter context with full privileges. Here the string is hardcoded, so immediate exploitability is lower, but exec still normalizes an unsafe pattern and would become high risk if the test code were ever influenced by external input.
- Content
python # 运行测试代码 try: exec(test_code) return True except Exception as e: print(f"❌ 验证失败: {e}")
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 85% confidence
- Finding
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
- Content
python try: # 如果是相对路径或环境变量路径 if path == "tesseract": result = os.system(f"{path} --version >nul 2>nul") if result == 0: print(f"[成功] Tesseract在环境变量中可用") tesseract_found = True
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Ubuntu/Debian)
bash sudo apt-get install tesseract-ocr sudo apt-get install tesseract-ocr-eng sudo apt-get install tesseract-ocr-chi-sim # For Chinese
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Ubuntu/Debian)
bash sudo apt-get install tesseract-ocr sudo apt-get install tesseract-ocr-eng sudo apt-get install tesseract-ocr-chi-sim # For Chinese
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Ubuntu/Debian)
bash sudo apt-get install tesseract-ocr sudo apt-get install tesseract-ocr-eng sudo apt-get install tesseract-ocr-chi-sim # For Chinese
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Ubuntu/Debian)
bash sudo apt-get install tesseract-ocr sudo apt-get install tesseract-ocr-eng sudo apt-get install tesseract-ocr-chi-sim # For Chinese
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README describes screenshot capture, OCR extraction, output to files, and timed monitoring, but does not warn that these operations may collect and persist highly sensitive on-screen information. In a screen-viewing skill, missing privacy and data-handling warnings increases the risk of accidental collection of secrets, personal data, or confidential enterprise content.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README advertises timed monitoring and repeated screenshot capture, which materially increases the surveillance capability of the skill beyond simple one-off screenshot/OCR use. In an AI-assistant context, this can enable bulk collection of sensitive on-screen data such as messages, credentials, or internal documents without clear user-facing guardrails or consent guidance.
- Content
Static analysis
No suspicious patterns detected.