Security audit

Image Knowledge Converter

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its image-to-document purpose, but it can send screenshot content to cloud services even when related config flags appear disabled.

Review before installing. Use only a dedicated work folder, avoid sensitive screenshots unless you are comfortable sending them to the configured cloud providers, remove unused API keys from config files instead of relying on enabled:false, and run dependency installation in an isolated virtual environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: auto_process_all_v9_4.py:254
Finding: Disabled cloud features can still transmit user content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: auto_process_all_v9_4.py:652
Finding: LLM-controlled category names can escape the intended output directory
Content: View full analysis
:"/\\|?*\n\r\t]', '', category).strip() if not category or len(category) < 2 or len(category) > 10: category = '其他' doc_name = f"{category}-{title}" ``` The category is then directly appended to the output directory: ```python cat_dir = self.output_dir / category cat_dir.mkdir(exist_ok=True) safe_name = re.sub(r'[<>:"/\\|?*]', '', doc_name) if len(safe_name) > 40: safe_name = safe_name[:40] md_file = cat_dir / f"{safe_name}.md" ``` The same unsafe category path construction is used for Word documents: ```python cat_dir = self.output_dir / category cat_dir.mkdir(exist_ok=True) safe_name = re.sub(r'[<>:"/\\|?*]', '', doc_name) if len(safe_name) > 40: safe_name = safe_name[:40] docx_file = cat_dir / f"{safe_name}.docx" ``` ### Technical Analysis The sanitizer removes `/` and `\`, but it does not reject the special path component `..`. The category `..` is exactly two characters long and therefore passes the length validation. With `self.output_dir` set to `WORK_DIR / "处理结果"`, this expression: ```python self.output_dir / '..' ``` resolves to the parent work directory. No canonicalization or containment check verifies that the resulting path remains below `self.output_dir`. Although the category is returned by a cloud LLM, its output is influenced by OCR text supplied from the input image. A crafted screenshot can contain prompt-like text asking the model to emit a category of `..`. Model behavior is probabilistic, but the vulnerable sink accepts suc ...[truncated 1784 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: setup_wizard.py:101
Finding: Setup automatically installs dependencies without reproducible integrity verification
Content: View full analysis
=6.0,<7': 'yaml', 'requests>=2.31,<3': 'requests', 'python-dotenv>=1.0,<2': 'dotenv', 'Pillow>=10.0,<12': 'PIL', } ``` The dependency manifests also contain broad lower bounds: ```text PyYAML>=5.4.0 requests>=2.28.0 python-dotenv>=0.21.0 Pillow>=8.0.0 ``` ```text opencv-python>=4.5.0 numpy>=1.19.0 pytesseract>=0.3.8 scikit-learn>=0.24.0 scipy>=1.6.0 pandas>=1.2.0 tqdm>=4.60.0 python-dateutil>=2.8.0 ``` ### Technical Analysis The wizard downloads and installs whichever package release currently satisfies the configured range. It does not use: - Exact dependency versions. - Package hashes. - A reviewed lock file. - A fixed package index. - Signature or provenance verification. - User confirmation immediately before installation. Python package installation can execute package build hooks and other installation logic with the permissions of the user running the wizard. A future compromised release, malicious index response, or dependency takeover could therefore introduce code not present during the Skill audit. The package names passed to `install_package` are hard-coded and ...[truncated 1460 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (131)

Tainted flow: 'headers' from os.getenv (line 433, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · auto_process_all_v9_4.py (reported line 443)May include surrounding context.
python
"X-TC-Region": "ap-guangzhou" } resp = requests.post(f"https://{host}", data=payload_str, headers=headers, timeout=30) if resp.status_code == 200: result = resp.json() if 'Response' in result and 'Choices' in result['Response']:

Tainted flow: 'url' from os.getenv (line 478, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · auto_process_all_v9_4.py (reported line 479)May include surrounding context.
python
model = os.getenv('SILICONFLOW_MODEL', 'Qwen/Qwen3-8B') url = f"{base_url}/chat/completions" resp = requests.post(url, json={ "model": model, "messages": [{"role": "user", "content": prompt}], "max_tokens": 300, "temperature": 0.3

Tainted flow: 'url' from os.getenv (line 478, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · auto_process_all_v9_4.py (reported line 501)May include surrounding context.
python
try: api_key = os.getenv('MOONSHOT_API_KEY', '') url = "https://api.moonshot.cn/v1/chat/completions" resp = requests.post(url, json={ "model": "moonshot-v1-8k", "messages": [{"role": "user", "content": prompt}], "temperature": 0.3

Direct flow: os.getenv (credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · auto_process_all_v9_4.py (reported line 528)May include surrounding context.
python
) if not base_url: return None resp = requests.post( f"{base_url}/chat/completions", json={ # 注意：doubao-lite-4k 已下线，使用 volcengine/doubao-seed-2.0-mini

Tainted flow: 'headers' from os.getenv (line 433, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: The skill synchronizes processed OCR/LLM content to the external IMA note service and authenticates with secrets loaded from local config/environment, but there is no clear per-run consent or transmission warning at the point of export. In a screenshot-to-knowledge-base tool, this is dangerous because users may feed sensitive screenshots, causing inadvertent exfiltration of extracted content to a remote service.
Content: Scanner excerpt · auto_process_all_v9_4.py (reported line 1630)May include surrounding context.
python
'ima-openapi-apikey': self.api_key, 'Content-Type': 'application/json' } response = requests.post(f"{self.base_url}/{endpoint}", json=payload, headers=headers, timeout=30) if response.status_code == 200: return response.json() elif response.status_code == 403:

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · README_EN.md (reported line 364)May include surrounding context.
Check progress

python auto_process_all_v9_4.py --progress

Clear state

python auto_process_all_v9_4.py --clear

text

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · README_EN.md (reported line 427)May include surrounding context.
Check progress

python auto_process_all_v9_4.py --progress

Clear state

python auto_process_all_v9_4.py --clear

text

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented primarily as an image-to-knowledge tool, but the file materially includes a configuration-wizard flow that reads local templates and generates credential-bearing YAML files. Under-describing credential-management behavior is risky because users may not realize the skill is orchestrating sensitive configuration file creation and processing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented primarily as an image-to-knowledge tool, but the file materially includes a configuration-wizard flow that reads local templates and generates credential-bearing YAML files. Under-describing credential-management behavior is risky because users may not realize the skill is orchestrating sensitive configuration file creation and processing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented primarily as an image-to-knowledge tool, but the file materially includes a configuration-wizard flow that reads local templates and generates credential-bearing YAML files. Under-describing credential-management behavior is risky because users may not realize the skill is orchestrating sensitive configuration file creation and processing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented primarily as an image-to-knowledge tool, but the file materially includes a configuration-wizard flow that reads local templates and generates credential-bearing YAML files. Under-describing credential-management behavior is risky because users may not realize the skill is orchestrating sensitive configuration file creation and processing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill is presented primarily as an image-to-knowledge tool, but the file materially includes a configuration-wizard flow that reads local templates and generates credential-bearing YAML files. Under-describing credential-management behavior is risky because users may not realize the skill is orchestrating sensitive configuration file creation and processing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented primarily as an image-to-knowledge tool, but the file materially includes a configuration-wizard flow that reads local templates and generates credential-bearing YAML files. Under-describing credential-management behavior is risky because users may not realize the skill is orchestrating sensitive configuration file creation and processing.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.
md
- ✅ **路径修复**：`SKILL.md` 移除所有硬编码示例路径，改为 `{工作文件夹}` 占位符

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · auto_process_all_v9_4.py (reported line 84)May include surrounding context.
python
sys.path.insert(0, '.') from dotenv import load_dotenv env_path = Path('.') / '.env' if env_path.exists(): load_dotenv(dotenv_path=env_path) else:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · auto_process_all_v9_4.py (reported line 88)May include surrounding context.
python
if env_path.exists(): load_dotenv(dotenv_path=env_path) else: print("[INFO] .env 文件不存在，使用 config/api_keys.yaml 配置（正常）") try: from local_ocr import LocalOCR

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · auto_process_all_v9_4.py (reported line 241)May include surrounding context.
python
if env_path.exists(): load_dotenv(dotenv_path=env_path) else: print("[INFO] .env 文件不存在，使用 config/api_keys.yaml 配置（正常）") try: from local_ocr import LocalOCR

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Automatic package installation is not necessary for a setup wizard to explain configuration and creates a powerful side effect: modifying the system and fetching code from external repositories. In skill-review context this is more dangerous because the manifest suggests image/OCR processing, not environment mutation, so users and operators may not anticipate software installation behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README advertises cloud OCR and IMA sync for user screenshots and extracted text, but it does not prominently disclose that sensitive image contents and derived text may be sent to third-party providers such as Tencent, Baidu, or IMA. Because screenshots often contain personal, financial, medical, or chat data, insufficient disclosure can lead users to unknowingly transmit sensitive information off-device.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The trigger phrase "初始化" is generic and can plausibly appear in normal conversation, increasing the chance of unintended activation of the setup workflow. In an agent environment, accidental invocation may lead to unwanted file creation, configuration changes, or prompts that steer the user into handling secrets and local paths unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The phrase "处理新图片" is broad and action-oriented, making accidental triggering more likely in ordinary chat. If bound directly to processing, the skill could begin scanning local folders and transmitting screenshot contents to OCR or sync providers without sufficiently explicit user intent at that moment.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 293)May include surrounding context.
IMA 同步（可选，向导会问你要不要配置）

ima: api_key: "你的 IMA API Key" base_url: "https://api.ima.tencent.com/v1"

text
### 如何获取 API 密钥（向导会一步步教）

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README_EN.md (reported line 297)May include surrounding context.
IMA 同步（可选，向导会问你要不要配置）

ima: api_key: "你的 IMA API Key" base_url: "https://api.ima.tencent.com/v1"

text
### 如何获取 API 密钥（向导会一步步教）

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to perform filesystem access, environment-variable reads, shell execution, and network-backed workflows, but it does not declare any tool scope or permissions boundary. This is dangerous because a broad, undeclared capability set makes it harder for hosts and users to understand or constrain what the skill may do, increasing the risk of unintended command execution, file modification, and credential handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrase "第一次使用" is extremely broad and can appear in unrelated conversations, causing accidental activation of a skill that writes files and may later invoke shell commands. In context, this is more dangerous than a harmless collision because the skill performs setup actions affecting the local filesystem and credential workflow.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tainted flow: 'headers' from os.getenv (line 433, credential/environment) → requests.post (network output)

Tainted flow: 'url' from os.getenv (line 478, credential/environment) → requests.post (network output)

Tainted flow: 'url' from os.getenv (line 478, credential/environment) → requests.post (network output)

Direct flow: os.getenv (credential/environment) → requests.post (network output)

Tainted flow: 'headers' from os.getenv (line 433, credential/environment) → requests.post (network output)

Memory Manipulation

Check progress

Clear state

Memory Manipulation

Check progress

Clear state

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Ae1

Credential Access

Credential Access

Credential Access

Context-Inappropriate Capability

Missing User Warnings

Vague Triggers

Vague Triggers

External Transmission

IMA 同步（可选，向导会问你要不要配置）

External Transmission

IMA 同步（可选，向导会问你要不要配置）

Undeclared Tool Scope

Vague Triggers