Poocr Vatinvoice2excel

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.0.0

Overview

This invoice OCR skill matches its stated purpose, but it asks users to process sensitive invoices with cloud API credentials through an unpinned third-party package without enough privacy, credential, or supply-chain guidance.

Install only in an isolated environment, verify the poocr package source and version, avoid putting real cloud keys directly in shared code, use least-privilege Tencent Cloud credentials, and confirm that the invoices are allowed to be processed by Tencent Cloud before batch OCR.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party OCR Dependency Handles Cloud Credentials and Sensitive Invoice Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–50
Vulnerability Type: Unpinned third-party dependency with access to secrets and financial documents
Risk Level: Medium

Vulnerable Code

bash

pip install poocr

python

import poocr

# Single-invoice recognition and Excel export
poocr.ocr2excel.VatInvoiceOCR2Excel(
    input_path='invoice-file-path.pdf',
    output_path='output-directory',
    id='your-SecretId',
    key='your-SecretKey'
)

# Batch recognition of invoices in a directory
poocr.ocr2excel.VatInvoiceOCR2Excel(
    input_path='invoice-directory-path',
    output_path='output-directory',
    id='your-SecretId',
    key='your-SecretKey'
)

The snippet above is an English rendering of the path placeholders and comments in the audited code. The executable statements, package name, API, and credential parameters are unchanged.

Technical Analysis

The documented installation command retrieves poocr from the user's configured Python package index without specifying a version or validating an integrity hash. Consequently, the code installed at different times may differ from the code originally reviewed.

Python package installation can execute package-controlled build hooks. Importing the installed package and invoking its APIs also executes dependency-controlled code. The dependency is subsequently given Tencent Cloud SecretId and SecretKey values and paths to sensitive invoice documents. Although the examples contain placeholders rather than real credentials, normal use requires replacing those placeholders with valid secrets.

The project does not itself contain a malicious payload, and the audit found no evidence that the current poocr package is malicious. The vulnerability is the absence of dependency pinning and integrity verification at a high-trust boundary. The shortened credential-management link, https://curl.qcloud.com/9ExTmaya, fur ...[truncated 1735 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin poocr to an explicitly reviewed version rather than installing the latest available release.
2. Use a lock file or requirements file containing cryptographic hashes, and install with hash verification, such as pip install --require-hashes -r requirements.txt.
3. Document the expected package publisher, canonical source repository, reviewed version, and package index.
4. Prefer an isolated virtual environment and prevent unnecessary installation with elevated operating-system privileges.
5. Replace the shortened Tencent Cloud link with an official canonical console URL whose destination is immediately verifiable.
6. Load SecretId and SecretKey from environment variables or a dedicated secret manager rather than placing real credentials directly in source code.
7. Use short-lived credentials where supported and apply least-privilege IAM policies limited to the OCR operations required by this Skill.
8. Review dependency updates before changing the pinned version and scan the resolved dependency tree for known vulnerabilities and unexpected packages.
9. Clearly disclose that invoice content is processed through a cloud-backed OCR service so users can assess privacy, regulatory, and data-residency requirements.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to send invoice files and cloud API credentials to a third-party OCR service, but it does not disclose the privacy and data-handling implications. Invoices commonly contain sensitive financial and personal data, so users may unknowingly transmit regulated or confidential information off-platform without informed consent or safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. The natural-language content and examples are presented only in Chinese, which can effectively force a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.