Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent OCR tool for Chinese/English financial images, with some broader local analysis examples users should understand before use.
Install only if you intend to process local images with Tesseract, especially Chinese/English financial screenshots. Be careful with the Telegram and batch examples because they can process private or many local images if copied directly; verify OCR-derived financial data before relying on it.
The documented workflows default to financial/entity extraction and report generation rather than only converting images to text. In a skill ecosystem, this kind of capability drift increases risk because downstream users and policy engines may invoke it under the assumption of narrow OCR behavior, while it can infer and structure higher-value information from documents.
The documented workflows default to financial/entity extraction and report generation rather than only converting images to text. In a skill ecosystem, this kind of capability drift increases risk because downstream users and policy engines may invoke it under the assumption of narrow OCR behavior, while it can infer and structure higher-value information from documents.
The skill demonstrates shell execution and file-reading behavior but does not declare any tool scope such as permissions or allowed-tools. That creates an authorization/expectation gap: a caller may treat the skill as narrow OCR-only functionality while it can read local files, enumerate directories, and run shell pipelines over attacker-influenced paths.
The manifest describes an OCR tool for extracting text from images, but the examples document outputs such as company names, stock codes, financial metrics, keywords, sentiment, and summaries. Those behaviors are higher-level content analysis features rather than OCR itself, which makes the documented behavior materially broader than the stated skill purpose.
This markdown file includes example workflows that ingest Telegram-downloaded images and original message text, then extract and analyze their contents. Because this behavior can involve user-provided or potentially sensitive communication data, the description should include an explicit warning about privacy, consent, and careful handling of extracted content.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
## Integration with Other Tools
The documented pipeline performs text cleaning, entity extraction, sentiment/trend analysis, and report generation after OCR. While OCR is part of the flow, the manifest limits the skill to using Tesseract for text extraction from images, so the documented behavior suggests a broader analysis tool than advertised.
The usage text and variable initialization set the default OCR language to chi_sim+eng, which imposes a specific language/locale behavior unless the user overrides it manually. Under the policy, forcing a language without explicit opt-in or clear region-specific justification is a natural-language policy concern.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
echo "Error: Tesseract not found. Please install Tesseract OCR."
echo "Install via:"
echo " macOS: brew install tesseract"
echo " Ubuntu/Debian: sudo apt install tesseract-ocr"
echo " Fedora: sudo dnf install tesseract"
exit 1
fi
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
echo "Error: Tesseract not found. Please install Tesseract OCR."
echo "Install via:"
echo " macOS: brew install tesseract"
echo " Ubuntu/Debian: sudo apt install tesseract-ocr"
echo " Fedora: sudo dnf install tesseract"
exit 1
fi
The manifest describes an OCR tool for extracting text from images, but the main code path goes further by analyzing extracted text for company names, stock codes, financial metrics, and preset keywords, then generating an analysis report. That behavior is a substantive expansion from OCR extraction into financial-content analysis.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# Output to stdout
cmd.extend(['stdout', '-l', lang])
result = subprocess.run(
cmd,
capture_output=True,
text=True,
The manifest describes an OCR tool for extracting text from images, including financial charts and reports, but this code goes further by parsing OCR output into companies, stock codes, financial metrics, and keywords. That structured domain analysis is a distinct capability beyond straightforward text extraction.
After OCR, the skill automatically analyzes text for company names, stock codes, and financial metrics and prints an 'OCR ANALYSIS REPORT'. While OCR is within scope, this additional financial-analysis capability is not explicitly declared in the manifest as part of the skill's purpose.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print("Testing Tesseract installation...")
try:
result = subprocess.run(
['tesseract', '--version'],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# List available languages
try:
result = subprocess.run(
['tesseract', '--list-langs'],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
try:
# Test English OCR
result = subprocess.run(
['tesseract', found_image, 'stdout'],
capture_output=True,
text=True,
The manifest scopes this skill to using Tesseract for extracting text from images, but this section instructs use of a separate image-manipulation tool to transform images. While preprocessing can support OCR, bundling additional image-editing capability is not declared in the manifest and goes beyond the stated Tesseract-based OCR focus.
Batch and parallel processing expand the operational scope from single-image OCR to broad filesystem traversal and mass processing. In context this is not inherently malicious, but it can increase blast radius, resource consumption, and accidental processing of unintended files if invoked on large or sensitive directories.
The example workflow generates summaries using fixed Chinese phrases such as '提及公司', '主题', and '财务指标'. This imposes a specific output language in natural-language content without indicating that the language is configurable or intentionally limited to a Chinese-specific use case.
The code sets a default OCR language of 'chi_sim+eng', which imposes a specific language/locale configuration unless the user explicitly overrides it. This is a natural-language policy concern because the tool defaults to a particular language set rather than asking the user to choose or clearly justifying the locale constraint.
The command-line help text states that the default OCR language is 'chi_sim+eng', reinforcing a forced language choice in the user-facing interface. There is no nearby justification that this tool is intended only for Chinese/English financial documents or that users are expected to opt into that locale setting.
No suspicious patterns detected.