Image OCR Reader

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:48 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local OCR helper that reads user-selected image files and optionally writes OCR output, with no hidden network, persistence, or credential behavior found.

Install Tesseract and Python packages only from trusted sources, preferably in a virtual environment, and consider pinning dependency versions. Only run OCR on image files you intend to process and choose the optional output path carefully because it will write extracted text there.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Dependencies Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:35
Vulnerability Type: Supply-chain risk from unpinned dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install pytesseract Pillow

Technical Analysis

The documented installation command retrieves the latest package versions matching their names from the Python package index configured in the user's environment. It does not pin reviewed versions, verify cryptographic hashes, or require a trusted package source.

The minimum-version constraints in _meta.json do not provide reproducible dependency resolution:

json

"pytesseract": ">=0.3.0",
"Pillow": ">=8.0.0"

Consequently, the code installed by users can change after this Skill has been reviewed. If an allowed dependency, its transitive dependencies, or the configured package repository is compromised, attacker-controlled code may be installed. Package installation and subsequent imports can execute that code in the user's environment.

Attack Path

1. An attacker compromises a permitted package release, one of its transitive dependencies, or the package index configured for pip.
2. A user follows the installation instructions and runs pip install pytesseract Pillow.
3. Because no exact versions or hashes are required, pip resolves and downloads the compromised package.
4. Attacker-controlled package code executes during installation, import, or later OCR operations.
5. The malicious code operates with the privileges of the account or environment that installed and runs the Skill.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the installing or invoking user's privileges. Depending on that account's permissions, the attacker could read or modify accessible files, steal environment variables or credentials, alter the Python environment, and compromise OCR input or output. If installation is performed with ...[truncated 309 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed lock file or requirements file containing exact versions for direct and transitive dependencies.

2. Record cryptographic hashes and require verification during installation, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Replace open-ended constraints such as >=0.3.0 with versions synchronized with the reviewed lock file.

4. Configure and document an approved HTTPS package index or an internally controlled dependency mirror.

5. Perform dependency vulnerability and provenance checks before updating locked versions.

6. Install dependencies inside an isolated virtual environment under a non-privileged account, and explicitly discourage using sudo pip.

7. Establish a controlled update process in which dependency changes are reviewed, scanned, tested, and assigned new hashes before release.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt-get install tesseract-ocr

# macOS
brew install tesseract

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt-get install tesseract-ocr

# macOS
brew install tesseract

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring states support for Chinese and English and the implementation defaults OCR language to chi_sim+eng, presenting a specific language/locale choice as the default behavior. The policy requires avoiding forced language or locale constraints unless the user is given a choice or the constraint is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The primary descriptive text is written in Chinese and states support for Chinese and English OCR, but the skill documentation itself does not offer an English-language option or explain that the skill is intended only for a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The module description uses Chinese-only natural language ('模块入口') in a way that may impose a specific language/locale without offering user choice. Under the policy, language constraints should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest description states that the skill supports Chinese and English recognition, which imposes a specific language scope in natural-language metadata without offering user choice or clarifying that other languages may be configurable. Under the policy, language constraints should be opt-in or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.