Security audit
Security checks for vulnerabilities and agentic risk
This skill is purpose-built for bank and legal document sorting, but it uploads full identity and application images to an external vision API without a clear consent or privacy control.
Review before installing. Use this only if you are allowed to send the scanned IDs, bank forms, and legal materials to the Doubao/Volcengine API, and avoid running it on regulated or client-confidential files without explicit approval. Prefer adding an upload confirmation, redaction or local-only mode, and masked logging before production use.
The skill claims a full local-first pipeline with extraction, matching, cross-validation, and segregated manual-review outputs, but the described implementation does not actually enforce those safety and correctness controls. In a banking and legal document context, this mismatch can cause operators to trust automation that may silently omit validation steps, mishandle records, or mix households incorrectly.
The skill explicitly states that document images stay local except for the recognition step, which means IDs and application forms containing highly sensitive personal data are sent to an external vision model. Without a clear privacy warning, consent step, retention notice, and third-party data handling disclosure, users may unknowingly exfiltrate regulated personal and financial identity data.
The workflow includes code and instructions to transmit images of身份证 and bank application materials to an external API, but there is no mandatory user confirmation or safety interlock before sending this sensitive content. In context, this is especially dangerous because the materials contain government IDs, names, ID numbers, and financial application data that may be subject to strict privacy, banking, and legal confidentiality obligations.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import sys, os, json, base64, urllib.request, time, glob, re
def get_env_key(var_name, env_path=None):
"""优先读环境变量；没有则依次找常见 .env 位置（不写死任何机器路径）"""
if os.environ.get(var_name):
return os.environ[var_name]
cands = [env_path] if env_path else []
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import sys, os, json, base64, urllib.request, time, glob, re
def get_env_key(var_name, env_path=None):
"""优先读环境变量；没有则依次找常见 .env 位置（不写死任何机器路径）"""
if os.environ.get(var_name):
return os.environ[var_name]
cands = [env_path] if env_path else []
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if os.environ.get(var_name):
return os.environ[var_name]
cands = [env_path] if env_path else []
cands += [os.path.expanduser("~/.env"),
os.path.join(os.path.expanduser("~"), ".config", ".env"),
os.path.join(os.getcwd(), ".env")]
for p in cands:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if os.environ.get(var_name):
return os.environ[var_name]
cands = [env_path] if env_path else []
cands += [os.path.expanduser("~/.env"),
os.path.join(os.path.expanduser("~"), ".config", ".env"),
os.path.join(os.getcwd(), ".env")]
for p in cands:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if os.environ.get(var_name):
return os.environ[var_name]
cands = [env_path] if env_path else []
cands += [os.path.expanduser("~/.env"),
os.path.join(os.path.expanduser("~"), ".config", ".env"),
os.path.join(os.getcwd(), ".env")]
for p in cands:
The code transmits full images of IDs, applications, and contracts to an external API without any built-in warning, consent prompt, or policy guard in the script. Because this skill is specifically designed for bulk householding of bank and legal document scans, the data is likely to include PII and regulated financial information at scale, making undisclosed external transmission especially dangerous.
The skill describes capabilities that require filesystem access, environment variable use, and outbound network calls, but it does not declare an explicit tool/permission scope. This creates an authorization ambiguity where a high-risk workflow handling sensitive identity documents could run with broader capabilities than users realize or approve.
该技能是 markdown 文件，适用 SQP-1。L018 的触发词列表包含“归户”“OCR 分类”等高度泛化表述，且未给出排除条件或负面示例，容易与大量普通文档整理、OCR 或归档场景重叠，造成非预期调用。
L026 再次列出触发词，其中“扫描件拆分”“材料按户分开”“OCR 分类”等表达未限定行业、输入结构或输出目标，也没有说明哪些相似请求不应触发该技能。重复且宽泛的触发定义会增加误调用风险。
The script base64-encodes full scanned document images and sends them to a remote vision API. In this skill context, the images contain highly sensitive identity and banking documents, so transmitting raw images off-host creates significant privacy, compliance, and data-handling risk, especially if users are not clearly informed that third-party processing occurs.
The script prints model output directly to stdout, which may include names, ID numbers, and issuing authority data extracted from identity documents. In shared terminals, CI logs, remote shells, or captured session transcripts, this can leak sensitive personal data beyond the intended processing workflow.
文件整体以中文命名、描述和示例输出，且未见提供语言/locale 选择机制。按规则，若技能强制特定语言而没有用户 opt-in 或明确说明适用语言范围，可能构成自然语言策略问题。
The docstring states '断点续传+重试+usage累计', implying accumulated usage across resumed processing. However, when resuming from an existing output file, the script reloads prior classification results but resets token counters to zero, so usage totals reflect only the current invocation.
No suspicious patterns detected.