ocr-passport-xiangyun

• Outcome: Review
• Latest audit: May 28, 2026 · 9:44 AM UTC
• Version: 1.0.0

Overview

This passport OCR skill appears to do what it claims, but it handles passport data and API secrets in ways that deserve review before installation.

Install only if you are comfortable sending passport images to Xiangyun/netocr.com and storing extracted passport data locally. Treat config.json as a secret, avoid running the load command where output is logged, use --no-save unless cached results are needed, and keep passport images and generated JSON/CSV/Excel files out of shared or synced folders.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill presents itself primarily as passport OCR, but the documented behavior also includes credential persistence, automatic local caching of OCR results, batch directory scanning, and export to additional file formats. For a workflow handling highly sensitive identity documents, under-disclosing storage and export capabilities is dangerous because users may unknowingly allow broader collection, retention, and propagation of passport data than expected.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The load command outputs the stored API key and secret in plaintext to stdout, which can expose credentials through terminal history, logs, wrappers, screenshots, or upstream tool capture. In this skill context, the risk is elevated because the manifest says credentials are persisted locally for reuse, so a helper command intended only to check configuration status unnecessarily discloses long-lived secrets.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script documentation states results are printed to stdout for downstream use, but the implementation also persists extracted passport OCR data to disk by default. Because this data contains highly sensitive identity information, undocumented storage increases the risk of unintended retention, local disclosure, backup propagation, and later exfiltration.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code automatically saves recognized passport data to a JSON file next to the source image unless the user explicitly disables it. In the context of passport OCR, this creates unnecessary at-rest copies of sensitive PII, increasing exposure through shared directories, weak endpoint security, backups, sync tools, and multi-user systems.

Intent-Code Divergence

Low

• Confidence: 78% confidence
• Finding: The comment suggests unknown fields are retained only for debugging, but the code later exposes extra fields in table output and includes them in saved JSON results. For an external OCR API, undocumented fields may contain additional sensitive data, causing overcollection and accidental disclosure beyond the intended passport fields.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to provide OCR API credentials and states they will be persisted to config.json, but it does not prominently warn that these are secrets that can authorize billable third-party API usage. Storing such credentials in plaintext in the skill directory increases the risk of accidental exposure through backups, logs, repository commits, or local compromise.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill directs users to submit passport images and extracted identity data to a third-party OCR service without a clear upfront privacy notice or consent step. Passport images contain highly sensitive personal data, so silently transmitting them off-device to an external provider creates material confidentiality, regulatory, and data-handling risks.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill states that OCR results are automatically saved as JSON alongside the source image by default, but it does not provide a prominent warning that this creates local persistence of sensitive passport data. Automatic storage of identity-document fields can expose users to unauthorized access, accidental sharing, inclusion in backups, or later exfiltration from directories they did not expect to contain sensitive data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly instructs sending passport images and OCR API credentials to a third-party service, but provides no privacy warning, consent guidance, retention notice, or data-handling caveats. Because passport images contain highly sensitive identity data and may include MRZ data, transmitting them to an external processor without clear disclosure materially increases privacy, compliance, and credential-exposure risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Printing credentials in plaintext is a direct secret-disclosure issue, and the lack of any warning or confirmation makes accidental exposure more likely during normal troubleshooting or agent execution. Because these are API credentials for an external OCR service handling passport data, compromise could enable unauthorized API use, billing abuse, or access to sensitive document-processing workflows.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script sends passport images and API credentials to a third-party remote OCR service, but there is no explicit execution-time warning or consent flow informing the user that highly sensitive identity data leaves the local system. In this skill context, that omission is significant because passports contain regulated, high-value PII and users may assume local-only processing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script silently writes recognized passport data to a local JSON file during normal execution without a prominent warning. Because the output contains sensitive identity data, silent persistence materially increases the chance of accidental disclosure to other users, processes, cloud sync services, or forensic recovery.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.