Security audit

Image Table Extractor Lz

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent table-extraction purpose, but it may upload user images to a third-party service and handle an API key without clear consent or secret-handling guidance.

Review before installing. Use this only for images you are comfortable sending to the Ketop endpoint, and avoid confidential screenshots, regulated records, personal data, or proprietary tables unless the publisher documents consent, retention, and privacy handling. Store the API key through a proper secret mechanism rather than pasting it into chat or logs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad and overlap with common user requests such as '提取图片数据' or '图片表格提取', which can cause the skill to activate in situations beyond its intended scope. Over-broad invocation increases the chance of unintended processing of user-supplied images and accidental use of fallback behaviors or external references without clear user intent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation guidance says to use the skill whenever a user needs table extraction, content recognition, or data export, but it does not define boundaries for when the skill should not run. This ambiguity is riskier in context because the skill also instructs the agent to switch models and consult external references, creating opportunities for unnecessary or unintended handling of sensitive image content.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill instructs the user to obtain a secret access key and place it into an environment variable without any guidance on secure handling, storage limits, redaction, or avoiding disclosure in logs and transcripts. In an agent setting, this increases the risk that sensitive credentials are exposed to the model context, shell history, process listings, or diagnostic output.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The skill runs a local command against a user-supplied absolute file path with no validation or safety guidance. In an agent environment, this can lead to unauthorized local file access, accidental processing of sensitive files, or unsafe command construction if the path is later interpolated unsafely by surrounding tooling or operator behavior.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script uploads a user-supplied local file to a remote third-party endpoint for processing, but the code provides no explicit disclosure, consent prompt, domain allowlisting explanation, or privacy warning at the point of transmission. This is risky because image files may contain sensitive data, and users may reasonably expect a local extraction tool unless remote transfer is made unmistakably clear.

Static analysis

No suspicious patterns detected.