Iflytek Pdf Image Ocr

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:32 AM UTC
• Version: 1.0.1

Overview

This is a mostly normal cloud OCR skill, but its PDF URL mode can also upload a local PDF and the documentation does not clearly warn users that documents are sent to iFlytek.

Install only if you are comfortable sending selected images and PDFs to iFlytek for processing. Be especially careful with confidential, regulated, or client documents, and avoid using --pdf-url until the skill enforces a true file-or-URL choice so a local PDF is not uploaded unnecessarily.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pdf_ocr.py:93

Finding

PDF URL Mode Uploads an Unnecessary Local Document

Content

View full analysis

Vulnerability Details

File Location: scripts/pdf_ocr.py, lines 93-108
Vulnerability Type: Excessive data transmission and unintended document disclosure
Risk Level: Medium

The PDF client permits pdf_path and pdf_url to be supplied simultaneously. Rather than selecting one source, it includes both the complete local PDF and the remote URL in the request sent to iFlytek.

python

# Prepare multipart form data
files = None
data = {}

if pdf_path:
    with open(pdf_path, 'rb') as f:
        files = {'file': (pdf_path.name, f.read(), 'application/pdf')}
if pdf_url:
    data['pdfUrl'] = pdf_url

if export_format:
    data['exportFormat'] = export_format

url = f"{self.API_BASE}/start"

response = requests.post(url, headers=headers, data=data, files=files, timeout=60)

The command-line interface makes the risk more likely because pdf_path is a required positional argument even when --pdf-url is used. The README acknowledges this behavior, while SKILL.md describes the two inputs as alternatives and provides a URL-only example that the implementation does not support.

Technical Analysis

URL-based OCR only requires transmitting the URL from which the service should retrieve the document. Uploading a local PDF in the same request exceeds the minimum data access required for that mode.

There is no mutual-exclusion validation such as:

python

if bool(pdf_path) == bool(pdf_url):
    raise ValueError("Provide exactly one PDF source")

Consequently, when both values are present, the request contains a multipart file field holding the complete local document and a pdfUrl field. TLS protects the data in transit, and the destination is the declared iFlytek OCR endpoint, so this is not a covert exfiltration channel. Nevertheless, it can disclose an additional document that is unnecessary for the selected URL workflow.

The Base64 operations identified by the static pre-scan a ...[truncated 1678 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce that exactly one document source is accepted in start_task():

   python

   if bool(pdf_path) == bool(pdf_url):
       raise ValueError("Provide exactly one of pdf_path or pdf_url")
   

2. Make the CLI inputs mutually exclusive. Because one source is positional, the cleanest approach is to replace it with explicit options:

   python

   source = parser.add_mutually_exclusive_group(required=True)
   source.add_argument("--pdf-file", type=Path)
   source.add_argument("--pdf-url")
   

3. Construct the request body with an exclusive branch so that a local file can never be attached in URL mode:

   python

   if pdf_path is not None:
       with open(pdf_path, "rb") as f:
           files = {"file": (pdf_path.name, f.read(), "application/pdf")}
   else:
       data["pdfUrl"] = pdf_url
   

4. Update SKILL.md and README.md so that examples and parameter requirements accurately match the implementation.

5. Add tests that intercept the outgoing request and verify:

   • File mode includes file but not pdfUrl.
   • URL mode includes pdfUrl but no multipart file.
   • Supplying both sources is rejected before any file is opened or network request is made.
   • Supplying neither source is rejected.

6. Before external processing, clearly inform users that the selected document or URL will be transmitted to iFlytek and may contain sensitive information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description claims a broader skill covering both image OCR and PDF document recognition/conversion workflows. However, this code chunk only accepts an image file path, base64-encodes that image, and submits it to an OCR API. There is no code to open, parse, rasterize, upload, or otherwise process PDF files, nor any logic to convert PDFs to Word or handle PDF-specific extraction. The code does support OCR output in json/markdown text formats for images, which partially aligns with the image OCR portion of the description, but the declared PDF-related capabilities are not represented in the supplied code. Therefore the description overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code’s primary purpose is narrowly aligned with PDF document OCR and export workflow, which does match part of the description: extracting text from PDFs and converting PDFs to Word/Markdown/JSON. However, the description explicitly claims support for both image OCR and PDF recognition, including image-based OCR tasks. In the provided code, there is no image input handling, no image file parsing, no image OCR endpoint, and no logic for non-PDF OCR. The implementation only accepts a PDF path or PDF URL and calls PDF-specific API endpoints (/pdfOcr/start and /pdfOcr/status). Therefore, the description overstates the implemented capability in a material way.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to submit local images and PDFs to a third-party OCR service but does not clearly warn that document contents will leave the local environment and be processed externally. This can lead to inadvertent disclosure of sensitive data such as IDs, contracts, medical records, or internal documents, especially because OCR is commonly used on exactly those document types.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises capabilities that require environment access, filesystem writes, and network access, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where the runtime may grant broader capabilities than reviewers or users expect, increasing the chance of unintended data access, exfiltration, or file modification during OCR workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is broad enough that an orchestrator could invoke it for generic document or text-extraction requests without clear user intent to send content to this external OCR provider. In context, that is more dangerous because OCR inputs may contain sensitive documents, and over-broad routing increases the risk of unnecessary third-party data disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest examples are short and ambiguous, which can cause accidental activation on vague requests such as extracting text from a document without clarifying privacy expectations or whether remote OCR is acceptable. In this skill's context, ambiguous activation is risky because it may lead to sensitive PDFs or images being uploaded to a third-party OCR API unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation does not clearly warn that images and PDFs are transmitted to iFlytek's external service for processing. Because OCR targets often contain highly sensitive personal, legal, financial, or business data, lack of disclosure undermines informed consent and can result in unintended confidential data exposure to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This outbound requests.post sends user-provided image contents and metadata to an external service. While external transmission is expected for a cloud OCR client, it is still a genuine security/privacy concern in an agent skill because local files may be exfiltrated off-system without strong user awareness, classification checks, or destination controls.

Content

Scanner excerpt · scripts/image_ocr.py (reported line 140)May include surrounding context.

python

auth_url = self._generate_auth_url()

        # Send request
        response = requests.post(
            auth_url,
            json=request_data,
            headers={"Content-Type": "application/json"},

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code base64-encodes the entire local image and sends it to a third-party OCR endpoint, but the script provides no explicit warning, consent prompt, or clear disclosure that user-supplied file contents leave the local system. In an agent skill context, users may reasonably expect local file processing unless told otherwise, so this creates a real privacy and data-handling risk, especially for sensitive documents or images.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code uploads the user-supplied PDF or a referenced PDF URL to a third-party OCR service, which can expose sensitive document contents outside the local environment. In an OCR skill, this behavior is expected functionality, but it is still a real privacy and data-handling risk because there is no explicit consent prompt, warning, classification check, or control to prevent accidental transmission of confidential documents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.