ClawHub
Back to skill

Security audit

Tiexue Vision

Security checks for vulnerabilities and agentic risk

Overview

This image-recognition skill is mostly aligned with its purpose, but it can automatically edit shared Feishu chats or documents and send extracted text to Google Translate without clear per-use consent.

Review before installing in any workspace with sensitive images or shared Feishu documents. Use it only if automatic OCR writeback is acceptable, Google Translate egress is allowed by your data policy, and Feishu edit permissions are tightly scoped; prefer disabling or making translation and writeback explicit before production use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill sends OCR-extracted text from user-provided images to an external Google Translate endpoint whenever the text is ASCII-only. OCR output can contain sensitive data such as IDs, emails, internal documents, or credentials, so transmitting it off-box without explicit consent or minimization creates a real data-exfiltration and privacy risk.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill advertises automatic invocation for any image sent in chat or documents, without describing clear triggering boundaries, confirmation, or scope limits. In collaboration tools, broad auto-activation can cause unintended processing of sensitive images and unexpected write-back into shared content, creating privacy and integrity risks.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The description states that recognition results are written back into the original chat/document or emitted as a same-named .txt file, but it does not present this as a prominent user warning or consent boundary. Users may unknowingly cause modification of shared documents, message threads, or local directories, which can leak extracted text or overwrite expected workflows.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill claims local operation except for translation, and it accepts image paths or URLs, but it does not clearly warn that image URLs and extracted text may be transmitted to external services during retrieval or translation. This creates a data disclosure risk, especially if users process confidential images or documents under the assumption the workflow is entirely local.

Natural-Language Policy Violations

High
Confidence
95% confidence
Finding
The skill automatically translates detected English text into Chinese and writes the result back without user opt-in. This is risky because OCR output may contain sensitive or regulated content, and automatic translation can send that content to external APIs and alter the original meaning or record in chats and documents without approval.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code transmits OCR text to an external translation service without any user-facing notice, consent, or disclosure. Because image text may include confidential or regulated content, silent network transfer increases privacy, compliance, and data-handling risk beyond what a user would reasonably expect from local image recognition.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"postinstall": "node -e \"console.log('依赖已安装，准备使用')\""
  },
  "dependencies": {
    "@tensorflow/tfjs-node": "^4.12.0",
    "onnxruntime-node": "^1.15.0",
    "tesseract.js": "^5.0.5",
    "axios": "^1.7.2",
Confidence
84% confidence
Finding
Using caret ranges for dependencies allows newer semver-compatible releases to be installed over time, which can introduce unreviewed code or supply-chain regressions. In a skill that pulls in native/ML and network-capable packages, this increases the chance that a future compromised or breaking dependency is silently adopted.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "@tensorflow/tfjs-node": "^4.12.0",
    "onnxruntime-node": "^1.15.0",
    "tesseract.js": "^5.0.5",
    "axios": "^1.7.2",
    "node-fetch": "^3.3.2"
Confidence
84% confidence
Finding
The caret-pinned onnxruntime-node version permits automatic drift to later releases, reducing build reproducibility and increasing supply-chain exposure. Because this is a native/runtime package, unexpected updates can have outsized security and stability consequences.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "@tensorflow/tfjs-node": "^4.12.0",
    "onnxruntime-node": "^1.15.0",
    "tesseract.js": "^5.0.5",
    "axios": "^1.7.2",
    "node-fetch": "^3.3.2"
  }
Confidence
83% confidence
Finding
An unpinned tesseract.js dependency means the installed code may vary across environments and time, which weakens provenance control. While not proof of compromise, it expands supply-chain risk and can pull in vulnerable or malicious updates without explicit approval.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"@tensorflow/tfjs-node": "^4.12.0",
    "onnxruntime-node": "^1.15.0",
    "tesseract.js": "^5.0.5",
    "axios": "^1.7.2",
    "node-fetch": "^3.3.2"
  }
}
Confidence
97% confidence
Finding
The axios dependency is both unpinned and already identified as a known vulnerable version, so leaving it floating compounds existing risk with future uncertainty. Since axios is commonly used for outbound HTTP requests, related flaws can affect request routing, SSRF exposure, denial of service, or unsafe parsing behavior depending on how the skill uses it.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"onnxruntime-node": "^1.15.0",
    "tesseract.js": "^5.0.5",
    "axios": "^1.7.2",
    "node-fetch": "^3.3.2"
  }
}
Confidence
80% confidence
Finding
Using a caret range for node-fetch permits silent adoption of later releases, undermining deterministic builds and increasing supply-chain risk. In a package that likely performs remote fetches, unreviewed dependency changes are more sensitive than in a purely local utility.

Known Vulnerable Dependency: axios==1.7.2 — 10 advisory(ies): CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars); CVE-2026-25639 (Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig) +7 more

High
Category
Supply Chain
Confidence
99% confidence
Finding
The package explicitly includes axios 1.7.2, which is flagged with multiple advisories including SSRF-related and denial-of-service issues. This skill’s stated purpose involves image/text/object recognition and includes network libraries, so vulnerable HTTP client behavior is especially relevant if remote URLs, proxies, or external APIs are used anywhere in the skill.

Static analysis

No suspicious patterns detected.