ClawHub
Back to skill

Security audit

ocr-bankcard-xiangyun

Security checks across malware telemetry and agentic risk

Overview

This bank-card OCR skill does what it claims, but it handles real card data and API secrets in ways users should review before installing.

Install only if you are comfortable sending bank card images and OCR credentials to Xiangyun/netocr.com. Treat config.json, terminal output, cached JSON files, CSV, and Excel exports as sensitive; prefer --no-save, avoid processing real cards without consent and compliance review, delete cached results when finished, and do not share logs or config files containing API secrets.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The script automatically persists OCR output derived from bank card images into a sibling JSON file, even though the advertised behavior is recognition and stdout output. Because the saved data includes sensitive financial identifiers such as card number, holder name, validity date, and bank metadata, this creates an undisclosed local data-retention channel that can expose users to privacy, compliance, and accidental disclosure risks.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The documentation says results are printed for downstream use, but the CLI exposes a --no-save switch implying automatic persistence occurs by default. This discrepancy hides sensitive-data storage behavior from users and integrators, increasing the chance that bank card OCR results are written to disk without informed consent or operational safeguards.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill lacks an explicit warning that bank card images and parsed card details are transmitted to a third-party OCR service and also cached locally as JSON. Because bank card numbers and issuer details are sensitive financial data, omitting that disclosure undermines informed consent and can lead to privacy, compliance, and data-handling violations if users submit real cards without understanding where the data goes.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The setup flow asks users to provide API credentials and says they will be saved to config.json, but it does not clearly warn that the secret is stored locally in plaintext within the skill directory. Plain local secret storage increases the risk of credential theft by other local users, backups, logs, or accidental inclusion in shared files or repositories.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation instructs users to send highly sensitive financial data (bank card images, card numbers, and API credentials) to a third-party OCR service without any warning about privacy, retention, compliance, or secure handling. In the context of a bank card OCR skill, this is materially dangerous because users may unknowingly transmit regulated payment-card data and secrets off-platform, creating exposure to data leakage, misuse, or non-compliant processing.

Missing User Warnings

High
Confidence
99% confidence
Finding
The load command prints the stored API key and secret directly to stdout, which can expose credentials through terminal history, logs, shell capture, CI output, or other process monitoring. In this skill context, the values are long-lived API credentials for an OCR provider, so disclosure could enable unauthorized API use and account abuse.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill transmits full bank card images and related OCR data to a third-party remote service for processing, but does not provide an explicit user-facing disclosure or consent flow. Bank card images can contain highly sensitive financial and personal data, so undisclosed third-party transmission materially increases privacy, regulatory, and trust risks even if the transport uses HTTPS.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code automatically writes OCR output containing sensitive bank card details to a local JSON file without explicit warning. In the context of bank card processing, silent persistence is particularly dangerous because local files may be backed up, indexed, synced, or read by other users or tools, extending exposure well beyond the immediate OCR task.

Ssd 3

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to collect user API key and secret and persist them for later reuse. Long-term retention of secrets expands the attack surface and creates a durable compromise point, especially when combined with plaintext local storage and a workflow centered on sensitive financial-document processing.

Ssd 3

Medium
Confidence
93% confidence
Finding
The note instructing the system to always reread config.json to avoid prompting again normalizes indefinite reuse of stored credentials. This encourages persistent secret retention as a default behavior, which increases exposure duration and makes any local compromise more damaging over time.

External Transmission

Medium
Category
Data Exfiltration
Content
with open("bankcard.jpg", "rb") as f:
    img_b64 = base64.b64encode(f.read()).decode("utf-8")

resp = requests.post(
    "https://netocr.com/api/recogliu.do",
    data={
        "img": img_b64,
Confidence
83% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
import requests

with open("bankcard.jpg", "rb") as f:
    resp = requests.post(
        "https://netocr.com/api/recog.do",
        files={"file": ("bankcard.jpg", f)},
        data={
Confidence
84% confidence
Finding
requests.post( "https://

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.