Iflytek Ocr Invoice

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:32 AM UTC
• Version: 1.0.1

Overview

The skill appears to perform its stated invoice OCR function, but it needs Review because its documentation tells users to print API secrets and it uploads sensitive document images to a third-party OCR service with limited privacy warning.

Install only if you are authorized to send the target invoices, receipts, bank slips, or medical bills to iFlytek for cloud OCR. Do not run the documented echo commands that print full secrets; use masked or presence-only checks instead. Prefer scoped iFlytek credentials and a protected secret manager or restricted environment file, and rotate the API key and secret if they were exposed in logs, screenshots, or chat.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:155

Finding

API Credentials Exposed by Troubleshooting and Persistence Instructions

Content

View full analysis

> ~/.zshrc ``` ### Technical Analysis The troubleshooting instructions tell users to print the complete values of `XFYUN_APP_ID`, `XFYUN_API_KEY`, and `XFYUN_API_SECRET` to the terminal. The API key and API secret are authentication credentials and should not be exposed in diagnostic output. Terminal output can be retained in CI logs, shell transcripts, screen recordings, screenshots, remote-support sessions, or terminal logging systems. The persistence example also encourages storing credentials as plaintext in a shell initialization file. If users enter analogous commands containing literal credentials, those values may additionally remain in shell history. This behavior is not required to diagnose whether the environment variables are configured. Presence checks or masked output would provide the same diagnostic value with substantially less exposure. ### Attack Path 1. A user encounters an authentication error and follows the documented troubleshooting instructions. 2. The commands print the complete API key and secret to the terminal, or the user stores credentials in a shell profile. 3. Terminal output, shell history, the profile file, a screenshot, or a support transcript becomes accessible to another person or process. 4. The exposed credentials are copied and reused to authenticate to iFlytek services available to the associated application. 5. The attacker may consume the account's API quota or access other service capabilities author ...[truncated 1163 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The troubleshooting instructions explicitly tell users to echo XFYUN_APP_ID, XFYUN_API_KEY, and XFYUN_API_SECRET to the terminal, exposing secrets in plaintext on screen and potentially in shell history, logs, screenshots, transcripts, or shared support channels. This can directly lead to credential compromise and unauthorized use of the OCR account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README describes sending invoice and receipt images to the iFlytek OCR API but does not warn users that these documents often contain sensitive personal, financial, tax, or medical data that will be transmitted to a third-party service. In a skill specifically designed for OCR of invoices, receipts, bank slips, and medical bills, this omission increases privacy and compliance risk because users may unknowingly upload regulated or confidential information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill requires environment variables and makes outbound network requests to a third-party OCR API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes the skill's operational capabilities less transparent to reviewers and users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Invoice and receipt images often contain sensitive personal, financial, medical, tax, and business data. The skill description does not clearly disclose that user-provided documents and extracted fields are sent to a third-party service, preventing informed consent and increasing privacy/compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

A large section of the skill documentation is written only in Chinese, with Chinese-facing guidance and examples, despite the rest of the file being in English and without stating that the skill is intentionally Chinese-only. This creates a language/locale constraint without user opt-in or explicit justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 72)May include surrounding context.

md

from urllib.parse import urlencode, urlparse
from wsgiref.handlers import format_date_time

API_URL = "https://api.xf-yun.com/v1/private/sc45f0684"


def build_auth_url(request_url: str, api_key: str, api_secret: str, method: str = "POST") -> str:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

from urllib.parse import urlencode, urlparse
from wsgiref.handlers import format_date_time

API_URL = "https://api.xf-yun.com/v1/private/sc45f0684"


def build_auth_url(request_url: str, api_key: str, api_secret: str, method: str = "POST") -> str:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/invoice.py (reported line 34)May include surrounding context.

python

from urllib.parse import urlencode, urlparse
from wsgiref.handlers import format_date_time

API_URL = "https://api.xf-yun.com/v1/private/sc45f0684"


def build_auth_url(request_url: str, api_key: str, api_secret: str, method: str = "POST") -> str:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends full invoice and receipt images to a third-party OCR service, which can expose sensitive financial and personal data such as names, account details, invoice numbers, and addresses. In an agent-skill context, the privacy risk is higher because users may not realize their documents are leaving the local environment unless the tool explicitly warns them and obtains consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill emits labels such as '票据类型' and bracketed field headings in Chinese regardless of user preference. This is a natural-language locale constraint that is not presented as optional, justified, or configurable.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/invoice.py:56