ClawHub
Back to skill

Security audit

smart_ocr

Security checks for vulnerabilities and agentic risk

Overview

This OCR skill is coherent and not deceptive, but users should handle sensitive documents carefully and install its dependencies in an isolated environment.

Install this in a dedicated virtual environment or container, pin dependency versions where possible, and avoid running OCR on sensitive IDs, receipts, or business documents unless you are comfortable with the extracted text and temporary images being handled by the agent. Only fetch remote images from URLs you explicitly trust, and adapt the sample code to use secure temporary files with cleanup.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:459
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 459-467
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash
# CPU version
pip install paddlepaddle paddleocr

# GPU version (CUDA 11.x)
pip install paddlepaddle-gpu paddleocr

# Additional dependencies
pip install pdf2image Pillow

Technical Analysis

The installation instructions retrieve and install third-party packages without version constraints, integrity hashes, a lock file, or an explicitly trusted package index. Consequently, the installed artifacts may differ between executions and can change after the skill has been reviewed.

Python package installation can execute package-controlled build or installation logic. If a dependency release or its distribution account is compromised, following these instructions could cause malicious code to run during installation. The absence of version pinning also increases the risk of incompatible or unexpectedly vulnerable transitive dependencies.

No evidence indicates that the currently named packages are malicious. The vulnerability is the unsafe, non-reproducible dependency installation process.

Attack Path

  1. An attacker compromises a listed dependency, its maintainer account, or an applicable package distribution channel.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented unpinned pip install command.
  4. Package resolution selects the attacker-controlled release.
  5. Malicious build or runtime code executes with the privileges of the user performing the installation.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the installing user or environment. Depending on those privileges, this may permit access to user-readable files, modification of the Python environment, theft of available credentials, or co ...[truncated 199 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every direct dependency to a reviewed, exact version.
  • Generate a lock file that also constrains transitive dependencies.
  • Require package hashes, such as through pip install --require-hashes.
  • Configure an explicitly trusted package index or an internally controlled dependency mirror.
  • Install packages inside a dedicated virtual environment or isolated container rather than a shared or privileged interpreter.
  • Regularly scan pinned packages for known vulnerabilities and review updates before changing versions.
  • Document compatible CPU and GPU dependency sets separately to prevent unintended resolver behavior.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:140
Finding

Predictable Temporary and Output Filenames Permit File Collisions and Unsafe Writes

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 140-150 and 267-270
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code

python
# Save temp image
temp_path = f'temp_page_{i}.png'
img.save(temp_path)

# OCR the image
result = ocr.ocr(temp_path)

# Extract text
page_text = '\n'.join([line[1][0] for line in result[0]])
all_text.append(f"--- Page {i+1} ---\n{page_text}")

os.remove(temp_path)

A second fixed output path is used during preprocessing:

python
# Save preprocessed
preprocessed_path = 'preprocessed.png'
img.save(preprocessed_path)

return preprocessed_path

Technical Analysis

Both examples create files with predictable relative names in the current working directory. The PDF workflow uses names such as temp_page_0.png, while preprocessing always writes preprocessed.png.

Existing files can be overwritten, simultaneous executions can interfere with each other, and stale content may be consumed by another process. If the working directory is writable by an attacker, the attacker may pre-create a conflicting file or filesystem link. A vulnerable image-writing operation may then follow that link and overwrite a file reachable with the OCR process's permissions.

The PDF cleanup is not protected by a finally block. If OCR or result processing raises an exception, temporary images may remain on disk. This can retain document content longer than intended and may expose sensitive scanned data to other users or later processes with access to the directory.

Attack Path

  1. The skill is executed from a shared or attacker-writable working directory.
  2. The attacker predicts a filename such as temp_page_0.png or preprocessed.png.
  3. The attacker creates a conflicting file or symbolic link at that path.
  4. The OCR workflow saves image data to the predictable path.
  5. The operation overwrites an existing file or ...[truncated 713 chars]
Remediation
View remediation

Remediation Suggestions

  • Use tempfile.TemporaryDirectory() or securely created NamedTemporaryFile instances instead of predictable paths.
  • Place all intermediate files in a private directory with restrictive permissions.
  • Generate unique filenames using secure operating-system primitives rather than page indexes or fixed names.
  • Ensure temporary resources are removed in a finally block or by using context managers.
  • Avoid writing preprocessing results to the current working directory.
  • Reject unsafe output locations and avoid following symbolic links where supported.
  • Define explicit behavior for existing output files instead of silently overwriting them.
  • Isolate concurrent jobs in separate temporary directories.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

OCR commonly processes sensitive personal, financial, and business information from images and scanned documents, yet the skill documentation does not warn users about privacy implications. In an agent setting, this omission can lead to inadvertent collection, extraction, or retention of personal data from IDs, receipts, cards, and documents without informed handling expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill includes example code that fetches OCR input from arbitrary URLs via requests.get(), expanding scope from user-provided local files to network retrieval. In an agent context, this can enable server-side request forgery, unintended access to internal resources, or retrieval of untrusted content without any validation, which is riskier than the stated OCR-only purpose requires.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest advertises text extraction using PaddleOCR, which implies OCR output from documents and images. The example code goes further by parsing emails, phone numbers, item lines, taxes, and totals into structured records, which is a broader document-understanding capability than simple text extraction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.