云启智联AI服务

• Outcome: Review
• Latest audit: Jul 30, 2026 · 12:54 AM UTC
• Version: 1.2.5

Overview

This appears to be a real finance OCR skill, but it needs review because it can upload sensitive financial documents to a third-party service and save parsed financial data locally with limited per-use control.

Install only if you are comfortable sending receipts, bank statements, invoices, and related metadata to yunqi-zhilian.com for OCR. Use explicit file paths, avoid triggering it for general finance discussions, prefer environment-variable or secure secret injection over command-line API keys, and delete generated HTML/JSON outputs if they contain sensitive financial data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'files' from open (line 257, file read) → requests.post (network output)

High

• Category: Data Flow

Content

resp = requests.get(url, headers=headers, timeout=30)
        else:
            if files:
                resp = requests.post(url, data=data, files=files, headers=headers, timeout=120)
            elif send_json:
                resp = requests.post(url, json=data, headers=headers, timeout=30)
            else:

• Confidence: 94% confidence
• Finding: resp = requests.post(url, data=data, files=files, headers=headers, timeout=120)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and instructs use of shell, network, local file read/write, and environment-backed API key handling, but no explicit permission declaration is present. That mismatch weakens platform trust boundaries and can lead to users or orchestrators invoking a skill with broader capabilities than they were clearly warned about, especially given it handles sensitive financial documents.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The instructions expand the skill from remote document parsing into local script creation and filesystem management, including bridge-script behavior. Even though the text discourages temp-file sprawl, it still authorizes code generation and execution patterns that increase attack surface and create opportunities for unintended local modification if prompts or inputs are abused.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The skill directs the agent to automatically generate HTML preview artifacts and JSON-related outputs on the user's filesystem for parsed financial documents. Those files may contain sensitive banking, invoice, or accounting data and can persist locally without clear consent, creating residual data exposure risks on shared or unmanaged systems.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The auto-trigger description uses broad keywords such as file parsing, query status, ping, accounting, and brand-related terms that can appear in ordinary conversation. In an agent setting, this can cause unintended invocation, leading to accidental transmission of files or metadata to the remote service and unexpected local side effects like artifact generation.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Ambiguous accounting phrases like generating vouchers, bookkeeping, debit/credit, or subject matching are common in general finance discussions and may activate the skill outside a document-OCR context. Because the skill can then initiate parsing workflows and local output generation, accidental triggering is more dangerous here than in a passive informational skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill processes highly sensitive financial documents but does not prominently warn that local files or file URLs are sent to a third-party remote service for OCR/parsing. Users may unknowingly disclose bank statements, receipts, invoices, and related metadata, making this a meaningful privacy and data-handling weakness in context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that HTML previews for sensitive financial records may be written locally and may fall back to current working directories or system temp directories, without a strong warning about residual sensitive artifacts. On multi-user machines, managed desktops, backups, or monitored temp locations, this can expose account details, transaction data, and document images beyond the intended session.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code reads a local file and sends it to a remote OCR service without an explicit warning in the execution path that the file contents are leaving the local environment. In the context of financial OCR, uploaded files may contain account numbers, transaction details, invoices, and personal or corporate identifiers, making silent transmission particularly risky.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Experience mode is especially sensitive because it lowers friction by not requiring an API key, yet it still uploads local files to a third-party service. Users may assume 'experience' is local or low-risk testing, but in reality it transmits potentially sensitive financial documents externally, increasing the chance of accidental disclosure.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: After parsing, the tool automatically writes financial data into local HTML preview files, which may persist sensitive transaction records and account information on disk without the user's awareness. On shared systems or synced home directories, these files may be exposed to other users, backups, or cloud synchronization services.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The code automatically saves generated voucher data to a local JSON file, potentially storing accounting entries, transaction metadata, and review hints in plaintext. Because this is financial data, silent persistence increases the risk of later unintended disclosure through local access, backups, or developer artifacts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The tool accepts the API key as a positional command-line argument, which can expose the secret through shell history, process listings, audit logs, and orchestration tooling. Even though the key is later encrypted at rest, it may already be disclosed to other local users or monitoring systems at invocation time.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The function automatically selects writable directories such as the user's home directory, current working directory, or temp directory and stores generated HTML containing financial voucher data there. In a finance-oriented skill handling bank receipts, statements, and invoices, silent local persistence increases the risk of sensitive data exposure to other local users, backup systems, shared workspaces, or unintended retention beyond the user's expectation.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.