Veryfi Documents AI

• Outcome: Pass
• Latest audit: May 28, 2026 · 2:39 AM UTC
• Version: 1.0.1

Overview

This is a legitimate Veryfi document OCR integration, but uploaded documents leave your environment and may contain sensitive personal or financial data.

Install only if you are comfortable sending the target documents to Veryfi under your account. Use environment variables or a secret store for credentials, avoid committing keys, test with sample documents first, and do not upload passports, tax forms, bank records, checks, medical documents, or other highly sensitive files until you have reviewed Veryfi’s privacy, retention, and compliance terms.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README provides copy-paste examples for uploading highly sensitive documents such as bank statements, passports, W-9s, and invoices to a third-party OCR service, but the usage section does not prominently warn users at the point of use that document contents are being transmitted off-platform. While the external transmission is the intended function of the skill, the missing contextual privacy warning increases the risk of accidental disclosure of financial and identity data by users who may not realize the sensitivity implications.

External Transmission

Medium

• Category: Data Exfiltration

Content

For Receipts and Invoices:
```bash
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 91% confidence
• Finding: This finding identifies the external Veryfi endpoint itself; using it means document contents and associated metadata leave the local trust boundary. In this skill, that transmission is central to operation and therefore a genuine security concern rather than a false positive, particularly because examples encourage sending full files and OCR content.

External Transmission

Medium

• Category: Data Exfiltration

Content

For Receipts and Invoices:
```bash
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 91% confidence
• Finding: This finding identifies the external Veryfi endpoint itself; using it means document contents and associated metadata leave the local trust boundary. In this skill, that transmission is central to operation and therefore a genuine security concern rather than a false positive, particularly because examples encourage sending full files and OCR content.

External Transmission

Medium

• Category: Data Exfiltration

Content

For Bank Statements:
```bash
curl -X POST "https://api.veryfi.com/api/v8/partner/bank-statements/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 95% confidence
• Finding: The bank statement workflow sends especially sensitive financial records to an external service, including transaction history, account holder details, balances, and routing information. That makes the transmission substantially more dangerous in context than a generic outbound API call.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Extract data from a Receipt or Invoice (file upload)

```bash
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 93% confidence
• Finding: This receipt/invoice upload example instructs direct file transfer to a third-party OCR provider, which can include names, addresses, payment details, and line-item purchase history. External transmission of such content is a true security/privacy issue even though it is functionally necessary for the service.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Encode the file first
BASE64_DATA=$(base64 -i invoice.pdf)

curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
  -H "Content-Type: application/json" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 94% confidence
• Finding: The base64 workflow is still external transmission, and may be riskier operationally because raw document content is embedded in JSON bodies where upstream tools, proxies, or logs might capture it. Sending whole documents this way can expose sensitive material if request logging is not tightly controlled.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Extract data from a URL

```bash
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
  -H "Content-Type: application/json" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 89% confidence
• Finding: Submitting a `file_url` to a third party can disclose the existence and location of internal or sensitive documents, and may cause the provider to fetch content from unintended sources. If users provide pre-signed, internal, or otherwise sensitive URLs, this can leak access tokens or expand exposure beyond the original environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Extract data from a Passport

```bash
curl -X POST "https://api.veryfi.com/api/v8/partner/any-documents/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 96% confidence
• Finding: The passport example involves transmission of government identity documents to a third party, which dramatically raises the sensitivity of the operation. Passports contain high-value identity data that can enable fraud or identity theft if mishandled, retained, or breached.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Extract data from Checks

```bash
curl -X POST "https://api.veryfi.com/api/v8/partner/checks/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 95% confidence
• Finding: The checks endpoint transmits images containing MICR data, payer/payee details, amounts, signatures, and other financial identifiers to an external provider. In context, this is highly sensitive banking information whose compromise could enable fraud or unauthorized financial activity.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Extract data from W-9s

```bash
curl -X POST "https://api.veryfi.com/api/v8/partner/w9s/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 96% confidence
• Finding: W-9 documents commonly contain taxpayer identity information such as legal name, address, and TIN/SSN-related data, so sending them to a third party is a serious privacy and compliance risk. The skill does warn generally about sensitivity, but still operationalizes direct transmission of highly regulated data.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# W-2
curl -X POST "https://api.veryfi.com/api/v8/partner/any-documents/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 96% confidence
• Finding: W-2 processing sends payroll and tax records to a third party, which can include SSNs, wages, employer identifiers, and addresses. This is especially dangerous because the skill presents it as a standard supported workflow for highly sensitive tax documents.

External Transmission

Medium

• Category: Data Exfiltration

Content

-F "blueprint_name=w2"

# W-8
curl -X POST "https://api.veryfi.com/api/v8/partner/any-documents/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 95% confidence
• Finding: W-8 forms can contain sensitive foreign tax and identity information, and the example sends them directly to an external OCR service. This is a genuine data exposure risk due to the nature of the documents involved, not merely a generic outbound connection.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Extract and pull ocr_text with jq
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 92% confidence
• Finding: The OCR text example highlights extraction of raw document text, which may contain dense sensitive information and can then be piped into other tools or LLMs, increasing downstream disclosure risk. This expands the blast radius beyond the initial upload by encouraging reuse of extracted plaintext.

External Transmission

Medium

• Category: Data Exfiltration

Content

Identify the document type without full data extraction. Useful for routing documents to the correct processing endpoint, pre-filtering uploads, or bulk sorting.

```bash
curl -X POST "https://api.veryfi.com/api/v8/partner/classify/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 88% confidence
• Finding: Even classification sends the full document to an external provider, so it still crosses a trust boundary despite being described as lighter-weight than extraction. Users may underestimate the privacy impact because the task is framed as 'classification only,' but the upload risk remains.

External Transmission

Medium

• Category: Data Exfiltration

Content

To classify against custom types, pass a `document_types` array:
```bash
curl -X POST "https://api.veryfi.com/api/v8/partner/classify/" \
  -H "Content-Type: multipart/form-data" \
  -H "Client-Id: $VERYFI_CLIENT_ID" \
  -H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \

• Confidence: 88% confidence
• Finding: Custom classification repeats the same third-party document upload pattern while potentially encouraging broader ingestion of arbitrary document types. That broadening of scope can lead users to send additional sensitive content without document-specific safeguards.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.