ClawHub
Back to skill

Security audit

GLM-OCR-Handwriting

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OCR wrapper that sends user-selected files or URLs to ZhiPu's GLM-OCR API and does not show hidden persistence, broad file access, or deceptive behavior.

Install only if you are comfortable sending selected images, PDFs, or remote file URLs to ZhiPu's OCR service along with your ZHIPU_API_KEY for authentication. Avoid using it for highly sensitive documents unless that external processing is acceptable for your privacy and compliance needs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
Findings (9)

Tainted flow: 'timeout' from os.getenv (line 147, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/glm_ocr_cli.py (reported line 150)May include surrounding context.

python
timeout = float(os.getenv("GLM_OCR_TIMEOUT", str(DEFAULT_TIMEOUT)))

    try:
        resp = requests.post(api_url, json=payload, headers=headers, timeout=timeout)
    except requests.Timeout:
        raise RuntimeError(f"API request timed out after {timeout}s")
    except requests.RequestException as e:

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
4. **IF API fails** — Display the error message and STOP immediately
5. **NO fallback methods** — Do NOT attempt handwriting recognition any other way

### 📋 Output Display Rules / 输出展示规则

After running the script, present the OCR result clearly and safely.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/glm_ocr_cli.py (reported line 62)May include surrounding context.

python
def get_config() -> tuple[str, str]:
    """
    Get API key from environment and use fixed official API URL.

    Returns:
        tuple of (api_url, api_key)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill advertises and instructs use of capabilities that include environment variable access, local file input/output, and outbound network access, but it does not declare any explicit tool scope or permissions boundary. This increases the blast radius because a host agent may grant broader capabilities than necessary, making misuse or future modifications harder to constrain and audit.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
脚本通过 `ZHIPU_API_KEY` 环境变量获取密钥，可与其他智谱技能复用同一个 key。
This script reads the key from the `ZHIPU_API_KEY` environment variable. Reusing the same key across Zhipu skills is optional.

**Get Key / 获取 Key：** Visit [智谱开放平台 API Keys](https://bigmodel.cn/usercenter/proj-mgmt/apikeys) to create or copy your key.

**Setup options / 配置方式（任选一种）：**

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
脚本通过 `ZHIPU_API_KEY` 环境变量获取密钥,可与其他智谱技能复用同一个 key。
This script reads the key from the `ZHIPU_API_KEY` environment variable. Reusing the same key across Zhipu skills is optional.

**Get Key / 获取 Key:** Visit [智谱开放平台 API Keys](https://bigmodel.cn/usercenter/proj-mgmt/apikeys) to create or copy your key.

**Setup options / 配置方式(任选一种):**

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The tool transmits user-supplied URLs or local file contents to an external third-party OCR API. In this skill context, that means potentially sensitive handwritten notes, documents, or PDFs may leave the local environment, creating privacy, compliance, and data exposure risk if users are unaware.

Content

Scanner excerpt · scripts/glm_ocr_cli.py (reported line 150)May include surrounding context.

python
timeout = float(os.getenv("GLM_OCR_TIMEOUT", str(DEFAULT_TIMEOUT)))

    try:
        resp = requests.post(api_url, json=payload, headers=headers, timeout=timeout)
    except requests.Timeout:
        raise RuntimeError(f"API request timed out after {timeout}s")
    except requests.RequestException as e:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest frames the skill as a handwriting-recognition tool, but the implementation exposes a generic GLM-OCR layout parsing workflow for arbitrary images and PDFs. The code returns full OCR text and layout details without any handwriting-specific restriction or handling, which materially broadens the behavior beyond the claimed scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documented options include returning cropped images and layout visualizations, which are analysis/artifact-generation features beyond simple handwritten text recognition. For a skill presented as reading handwriting and converting it to text, exposing image-derivative and layout-analysis features is unjustified scope expansion unless declared.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.