Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Veryfi OCR integration that sends selected documents to Veryfi, with real privacy risk for sensitive files but no hidden or deceptive behavior found.
Install only if you intend to send documents to Veryfi for processing. Use environment variables or a secret store for credentials, test with non-sensitive samples first, and do not process passports, tax forms, checks, bank statements, medical-related documents, or presigned/private URLs unless you have authorization and have reviewed Veryfi retention and compliance requirements.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
}
> If storing keys in `~/.openclaw/openclaw.json`, set file permissions with `chmod 600 ~/.openclaw/openclaw.json` and never commit it to version control.
## Quick Start
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
}
> If storing keys in `~/.openclaw/openclaw.json`, set file permissions with `chmod 600 ~/.openclaw/openclaw.json` and never commit it to version control.
## Quick Start
This example instructs users to upload local documents and send authentication credentials to a third-party API endpoint. In the context of an OCR/document-processing skill, external transmission is expected, but it still creates real data-exfiltration risk because potentially sensitive receipts or invoices and API secrets leave the local environment.
Extract data from a receipt or invoice:
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
This example sends bank statements to an external API, which involves highly sensitive financial data and account history. Although this is aligned with the skill's stated purpose, transmitting bank statements off-system materially increases privacy, compliance, and data exposure risk if used without strong controls.
Parse a bank statement:
curl -X POST "https://api.veryfi.com/api/v8/partner/bank-statements/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
This example transmits uploaded documents plus API credentials to an external classification endpoint. Classification may seem lower risk than extraction, but users could still unknowingly send confidential files to a third party, making the transmission itself security-relevant.
Classify a document:
curl -X POST "https://api.veryfi.com/api/v8/partner/classify/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
This example uploads identity documents such as passports to a third-party endpoint, which is especially sensitive because such files often contain government IDs and personal information. The feature is intentional, but the documentation normalizes external transmission of high-value identity data without strong caution at the point of use.
The Any Document endpoint supports 30+ document types via blueprints. Pass blueprint_name in the request:
curl -X POST "https://api.veryfi.com/api/v8/partner/any-documents/" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
-F "file=@passport.jpg" \
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Store API keys in environment variables or a secure secret store
- Never commit credentials to version control
- Set `chmod 600` on local config files containing keys
- Rotate keys regularly and monitor usage via the [Veryfi dashboard](https://app.veryfi.com)
- Test with non-sensitive sample documents before processing production data
- Review [Veryfi's privacy policy](https://www.veryfi.com/terms/) for data handling and retention details
The description uses broad trigger terms such as receipts, invoices, bank statements, fraud detection, classification, and 'any other document,' which increases the chance the agent invokes this skill for routine document requests without sufficient scoping. In an agent setting, overbroad invocation can lead to accidental transmission of sensitive files to an external service when the user did not intend third-party processing.
The skill references direct transmission to https://api.veryfi.com, confirming that user-provided files are sent off-platform for processing. This is dangerous when invocation is automatic or insufficiently scoped, because the agent may transfer sensitive business or personal records without informed approval.
For Receipts and Invoices:
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
The skill references direct transmission to https://api.veryfi.com, confirming that user-provided files are sent off-platform for processing. This is dangerous when invocation is automatic or insufficiently scoped, because the agent may transfer sensitive business or personal records without informed approval.
For Receipts and Invoices:
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
This example uploads bank statements to an external API, exposing highly sensitive financial records including account details, balances, and transaction history. Bank statements are substantially more sensitive than generic OCR inputs, so third-party transfer meaningfully raises privacy, fraud, and compliance risk.
For Bank Statements:
curl -X POST "https://api.veryfi.com/api/v8/partner/bank-statements/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
The receipt/invoice upload task sends document files to an external processor, which creates a data exposure channel for potentially confidential supplier, billing, and payment information. The risk is amplified in autonomous use because the skill is designed to make such transmission easy and routine.
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
The base64 workflow allows entire documents to be embedded and transmitted in JSON to the external API, increasing the likelihood that raw document contents are copied through logs, traces, or intermediary tooling in addition to the remote upload itself. This expands the exposure surface beyond simple multipart upload.
# Encode the file first
BASE64_DATA=$(base64 -i invoice.pdf)
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
-H "Content-Type: application/json" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
The file_url mode causes the external service to retrieve documents from a supplied URL, which can expose private document links or tokenized URLs to a third party. If users provide internal, presigned, or otherwise sensitive URLs, the skill can leak both the document and access token material.
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
-H "Content-Type: application/json" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
The skill explicitly supports uploading passports, checks, W-9s, W-2s/W-8s, bank statements, insurance and medical-related documents to a third-party API, which materially expands handling of highly sensitive identity, financial, and health-adjacent data. Even though the documentation includes privacy cautions, the skill still enables external processing of data classes that commonly require stricter consent, minimization, and compliance controls.
This workflow uploads passport images to an external API, directly handling government identity documents that contain high-value PII suitable for identity theft and fraud. In many environments, transmitting passports to a third party triggers elevated legal, contractual, and compliance obligations.
curl -X POST "https://api.veryfi.com/api/v8/partner/any-documents/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
Check images sent to the external API may contain payer/payee names, MICR data, routing information, signatures, and account-related details. That information can enable payment fraud or targeted scams if mishandled, making external transmission particularly sensitive.
curl -X POST "https://api.veryfi.com/api/v8/partner/checks/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
W-9 forms commonly contain tax identifiers and legal identity information, making their upload to a third-party OCR provider a high-risk transfer of regulated personal and business data. The agent context increases danger because a loosely scoped document request could unintentionally expose tax records.
curl -X POST "https://api.veryfi.com/api/v8/partner/w9s/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
W-2 documents contain highly sensitive employment, wage, and tax information, and transmitting them to an external processor creates a serious privacy and identity-theft risk. Because the skill advertises this capability as a standard task, the barrier to exposing regulated payroll data is too low.
# W-2
curl -X POST "https://api.veryfi.com/api/v8/partner/any-documents/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
W-8 forms also contain sensitive taxpayer and identity information, and their external processing can expose foreign-status and tax-related data unnecessarily. The risk is somewhat lower than W-2/W-9 in typical consumer contexts but still significant due to the sensitivity of the contents.
-F "blueprint_name=w2"
# W-8
curl -X POST "https://api.veryfi.com/api/v8/partner/any-documents/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
The skill encourages extracting raw OCR text and piping it onward, which can propagate full document contents into shells, logs, downstream tools, or LLMs after third-party processing. This increases secondary disclosure risk because unstructured OCR text often contains the most sensitive parts of a document.
# Extract and pull ocr_text with jq
curl -X POST "https://api.veryfi.com/api/v8/partner/documents/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
Even classification-only mode still uploads the document to a third-party API, so users may assume it is lower risk than extraction when the core transmission risk remains. This can lead to unnecessary external sharing of files just to determine type.
Identify the document type without full data extraction. Useful for routing documents to the correct processing endpoint, pre-filtering uploads, or bulk sorting.
curl -X POST "https://api.veryfi.com/api/v8/partner/classify/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
Custom classification broadens use to arbitrary document types while still sending the file to the external service, increasing the chance that unsupported or especially sensitive documents are uploaded. The open-ended nature of custom classes makes accidental misuse more likely.
To classify against custom types, pass a document_types array:
curl -X POST "https://api.veryfi.com/api/v8/partner/classify/" \
-H "Content-Type: multipart/form-data" \
-H "Client-Id: $VERYFI_CLIENT_ID" \
-H "Authorization: apikey $VERYFI_USERNAME:$VERYFI_API_KEY" \
The manifest explicitly requires API credentials and lists third-party Veryfi endpoints used for OCR, classification, and financial document processing, but the package metadata shown here contains no user-facing warning that sensitive document contents will be transmitted off-platform. Given this skill processes receipts, invoices, bank statements, checks, and W-9s, the omission creates a real privacy and consent risk because users may expose financial and personally identifiable information without clear notice.
This endpoint sends documents to Veryfi's external API for OCR and extraction, which is expected functionality for the skill but still constitutes real third-party data transmission. Because the skill is specifically designed to process potentially sensitive financial documents, use of the external endpoint is security-relevant and can expose confidential contents if users are not clearly informed or if transmissions are overbroad.
],
"primaryEnv": "VERYFI_CLIENT_ID",
"endpoints": [
"https://api.veryfi.com/api/v8/partner/documents/",
"https://api.veryfi.com/api/v8/partner/bank-statements/",
"https://api.veryfi.com/api/v8/partner/any-documents/",
"https://api.veryfi.com/api/v8/partner/checks/",
No suspicious patterns detected.