ClawHub
Back to skill

Security audit

发票识别（invoice-ocr-xy）翔云平台

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform invoice OCR as advertised, but it needs review because it handles sensitive invoices and OCR credentials with weak disclosure and unsafe runtime setup.

Review before installing. Use this only if you are comfortable sending invoice files to netocr.com, avoid pasting OCR secrets into chat, prefer a dedicated low-privilege NetOCR credential, and consider running it in an isolated environment with dependencies installed deliberately.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/recognize_invoices.py:48
Finding

OCR API Credentials Stored in Plaintext

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/recognize_invoices.py:264
Finding

Automatic Installation of an Unpinned Runtime Dependency

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises capabilities that imply reading files, writing config, invoking shell commands, and calling a remote OCR API, but it does not declare any tool scope or permissions boundaries. This creates unnecessary ambiguity for the agent/runtime and can enable broader-than-expected access when handling sensitive invoice documents and credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that invoice files are sent to a third-party OCR provider but does not prominently warn about data exfiltration, privacy, or regulatory implications. Invoices commonly contain PII, tax identifiers, bank details, addresses, and commercial data, so silent external transmission materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that invoice files are sent to a third-party OCR provider but does not prominently warn about data exfiltration, privacy, or regulatory implications. Invoices commonly contain PII, tax identifiers, bank details, addresses, and commercial data, so silent external transmission materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Instructing the agent to proactively solicit raw service credentials from the user in ordinary conversation is a direct secret-collection anti-pattern. In the context of invoice OCR, this is more dangerous because the same workflow also handles sensitive financial documents, concentrating both credentials and protected business data in a potentially logged channel.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script stores netocr_key and netocr_secret in plaintext config.json under the skill directory. Plaintext credential storage makes secrets easy to recover by other local users, backups, logs, or accidental file sharing, and the script does not warn users of this risk or use safer OS-backed secret storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The OCR function sends full invoice contents plus API credentials to a third-party remote service, but the script does not present an explicit runtime warning or consent step about external data disclosure. In this skill context, invoices commonly contain sensitive financial and personal data, so silent transmission materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Excel export path exceeds the expected OCR/format-conversion scope by mutating the host environment through package installation. This broadens the skill's privileges and creates a supply-chain execution path, especially risky in agent environments where users may not expect a file-processing skill to install software automatically.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

The script automatically runs pip install openpyxl during normal execution if the dependency is missing. Even though the subprocess arguments are fixed and not shell-injected, this still grants the skill package-management capability and triggers networked code installation without an explicit user opt-in, which can execute untrusted package code in the current Python environment.

Content

Scanner excerpt · scripts/recognize_invoices.py (reported line 272)May include surrounding context.

python
except ImportError:
        print("⚠️  导出 Excel 需要 openpyxl 库，正在自动安装...")
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "openpyxl", "-q"])
        import openpyxl
        from openpyxl.styles import Font, Alignment, PatternFill, Border, Side

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
74% confidence
Finding

SQP-3 适用于所有文件。该文件中的用户交互指令和示例话术均固定为中文，未见提供语言/locale 选择或声明这是仅面向中文用户/中国发票场景的受限技能；按规则，强制特定语言而无用户选择可能构成自然语言政策问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script's natural-language docstrings, prompts, help text, and status messages are entirely in Chinese, which imposes a language choice on all users. The file does not offer a language selection mechanism or explain that the tool is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.