Security audit

Image Knowledge Converter

Security checks across malware telemetry and agentic risk

Overview

The skill is broadly an image-to-document tool, but it needs Review because cloud processing and note sync can send screenshot-derived content off-device with weak or inconsistent user controls.

Install only if you are comfortable with screenshots and extracted text potentially being sent to Tencent/Baidu OCR, Tencent/Kimi/Doubao/SiliconFlow LLM services, and IMA when configured. Use local Tesseract-only mode for sensitive screenshots, avoid storing real API keys in repo/shared folders, review generated config files before processing, and back up images because processed files are moved into an archive.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (76)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: def install_package(package): """安装单个包""" try: result = subprocess.run( [sys.executable, '-m', 'pip', 'install', package, '-q'], capture_output=True, text=True,
Confidence: 95% confidence
Finding: The setup wizard automatically executes pip installs in the local environment without an explicit confirmation step at the moment of execution. Even though the package names are hardcoded and version-bounded, this still mutates the host environment, can pull code from package indexes, and creates supply-chain risk if an index, mirror, or dependency resolution path is compromised.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to read environment variables, read/write local files, invoke Python via shell, and contact external services, yet it declares no permissions. This creates a transparency and consent gap: users and hosts cannot accurately assess what the skill can access or do before activation, increasing the risk of over-privileged execution and unexpected data exposure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The advertised behavior is image-to-knowledge conversion, but the skill also handles credentials, may install packages, moves user files, generates additional document formats, and can sync data to an external IMA service. This mismatch undermines informed consent and can lead users to authorize actions with materially broader security and privacy consequences than the description implies.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill description presents screenshot-to-knowledge conversion, but the file also implements automatic synchronization of generated content to Tencent IMA. That expands data egress beyond the core stated purpose and can surprise users by sending OCR-derived content to an additional external service.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The note-publishing/import capability is broader than simple local image-to-knowledge conversion and can disclose processed content to a remote notebook service. In a tool handling screenshots, that raises privacy risk because screenshots often contain personal, proprietary, or sensitive material.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The template states that API keys 'will not be displayed or transmitted,' but the same file configures cloud OCR, LLM, and sync integrations that necessarily send credentials and/or user content to external providers during operation. This is a misleading security assurance that can cause users to enter sensitive credentials or process sensitive images under false assumptions about local-only handling.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The configuration enables automatic synchronization to an external system ('ima'), which expands the skill's behavior beyond local OCR and knowledge conversion into data exfiltration or unintended third-party transfer. In an image-processing workflow, screenshots may contain sensitive information, so automatic external sync increases privacy and security risk if users are not explicitly informed and consenting.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: Automatic updating of startup prompt text is outside the core stated purpose of image OCR and knowledge conversion, and it can modify agent behavior indirectly without clear user awareness. This creates a persistence or prompt-manipulation pathway where processed content or automation could alter future interactions in ways the user did not intend.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: A setup wizard for an image/OCR tool should not silently gain package-management capability without strong consent controls. Auto-installing packages broadens the trust boundary from the local script to external package infrastructure and can expose users to unintended code execution through the dependency chain.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README prominently advertises cloud OCR services and IMA synchronization, but it does not clearly warn users that screenshots and extracted text may be sent to third-party providers for processing. Because the skill handles personal screenshots that may contain sensitive information, this omission can lead users to unknowingly disclose private data to external services.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The documented trigger phrases such as "first time" and "initialize" are very generic and can plausibly appear in normal conversation, increasing the chance of unintended skill invocation. In a skill that can launch setup flows, create files, and guide users into configuring external services, accidental activation can cause confusing behavior and may expose users to unnecessary processing or credential-entry prompts.

Vague Triggers

Low

Confidence: 87% confidence
Finding: The command "reconfigure" is underspecified and may collide with other conversational or system contexts, causing the skill to relaunch configuration unexpectedly. While lower risk than initial setup triggers, it still creates an avoidable invocation ambiguity around a flow that can alter stored settings and prompt for sensitive service credentials.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The feature description highlights OCR, AI categorization, and cloud sync, but does not clearly warn users that screenshot contents may be transmitted to third-party OCR providers, LLM vendors, and optional sync services. Because screenshots often contain personal messages, account details, or other sensitive information, the omission undermines informed consent and increases privacy risk in ordinary use.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger phrase “第一次使用” is common conversational language and can activate the setup flow outside an intentional tool-use context. Because setup leads to file creation and later shell execution guidance, accidental invocation can cause unintended side effects or confuse users into disclosing local paths and starting configuration they did not mean to initiate.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The setup trigger list contains ambiguous phrases that lack scope constraints, making accidental or contextually unrelated activation more likely. In an agent environment, this can unexpectedly launch workflows that create files, request filesystem locations, or steer users toward running local scripts.

Vague Triggers

Low

Confidence: 74% confidence
Finding: The phrase “首次配置” is vague and may match ordinary discussion rather than a deliberate command. While lower risk than the more generic triggers, it still increases the chance of unintended workflow activation in a conversational interface.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill text does not clearly warn that image contents may be sent to cloud OCR/LLM providers and that processed content may be synchronized to an external IMA service. In this context, users may expose sensitive screenshots, documents, or embedded secrets to third parties without informed consent, making the privacy impact substantial.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: OCR text extracted from screenshots is forwarded to multiple external LLM providers, yet this file shows no user-facing consent or warning before transmission. Because screenshots commonly include sensitive personal or business data, silent third-party upload materially increases privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The IMA synchronization logic uploads generated note content to a remote service without an explicit warning in this file. Since the note content is derived from user screenshots, this can unintentionally externalize private information beyond local processing expectations.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code sends full image contents to Baidu's remote OCR API, which can expose screenshots containing sensitive data such as credentials, personal information, or internal documents to a third party. In a screenshot-to-knowledge-base tool, users may reasonably process sensitive images, so lack of explicit disclosure and consent increases privacy and data-handling risk.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The installation guide instructs that the skill may be auto-recognized and presents multiple broad natural-language trigger phrases without any clear scope checks, confirmation requirements, or limitations on what files and folders may be processed. In an agent environment, this increases the chance of unintended activation and autonomous handling of local data, especially because the same document also points the agent at concrete filesystem locations for input and output.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation explicitly tells users to edit source code and hardcode cloud OCR credentials via environment variable assignments inside `ocr_manager.py`. This encourages secrets to be stored in code files that may be committed to version control, shared with collaborators, or exposed in logs and backups, increasing the risk of credential leakage and unauthorized API use.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document describes automatic fallback from one OCR provider to other cloud OCR/AI vision services but does not disclose that user images may be transmitted to third-party providers with different storage, retention, or processing practices. In an image-to-knowledge-base skill, screenshots commonly contain sensitive content, so silent provider switching creates a meaningful privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The summary states that when free OCR quotas are exceeded, the system will automatically use AI vision recognition, but it does not warn that this may route data to a different service with distinct privacy, residency, or contractual controls. Users may reasonably assume processing behavior remains the same, leading to unintended disclosure of sensitive screenshots.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide states that processed images will be automatically moved to a different directory structure, but it does not prominently warn users before describing this behavior or explain the operational consequences. This can cause unintended file relocation, confusion during audits or backups, and potential data handling mistakes if users assume originals remain in place.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.