marketing-material-review-business

• Outcome: Review
• Latest audit: Aug 1, 2026 · 2:22 PM UTC
• Version: 1.1.8

Overview

The skill is mostly coherent for marketing-material compliance review, but it needs human review because it broadly loads local credentials/configuration, auto-installs dependencies, and sends image content to remote OCR while saving extracted artifacts.

Install only if you are comfortable sending reviewed images to Baidu OCR and saving OCR/report artifacts locally. Use a dedicated, trusted working directory, avoid untrusted .env files, pin or review dependencies before first run, restrict OCR endpoint variables to Baidu hosts, and clean the output directory when handling confidential campaigns.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"首次运行：正在创建 Python 环境 {venv_dir} ...", file=sys.stderr)
        try:
            venv_dir.parent.mkdir(parents=True, exist_ok=True)
            subprocess.run([base_python, "-m", "venv", str(venv_dir)], check=True)
            pip_command = [
                str(python_bin),
                "-m",

• Confidence: 67% confidence
• Finding: subprocess.run([base_python, "-m", "venv", str(venv_dir)], check=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-r",
                str(REQUIREMENTS),
            ]
            subprocess.run(pip_command, env=env, check=True)
            return str(python_bin)
        except (OSError, subprocess.CalledProcessError) as exc:
            errors.append(f"{venv_dir}: {exc}")

• Confidence: 92% confidence
• Finding: subprocess.run(pip_command, env=env, check=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares executable capabilities and operational dependencies such as shell, network, environment variables, and file I/O, but does not expose a matching permission model or bounded execution policy. In practice, it can create virtual environments, install dependencies, call external OCR services, read local files, and write outputs, which meaningfully expands the attack surface and can lead to unintended code execution, data exposure, or network egress under implicit trust.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document presents purported '2026 revision' legal requirements as authoritative without support from the cited current law text, which can cause the skill to make incorrect compliance judgments. In a legal/compliance review skill, fabricated or unverified legal updates are especially dangerous because users may rely on them to approve, reject, or modify advertising materials under false legal assumptions.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger phrases are broad and include common terms like '素材' and '文档帮我审核一下', making accidental invocation plausible in normal conversation. Because the skill can drive shell commands, OCR/network access, and file processing, unintended activation could cause unexpected handling of user files or transmission of content to external services such as Baidu OCR.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation text says the AI assistant will automatically recognize and return audit results, but does not clearly define when the skill should or should not run. In a skill that can access files, shell, and external OCR, ambiguous auto-invocation increases the risk of processing unintended content or triggering network/data egress without sufficiently informed user intent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: `run_ocr` sends image content to Baidu OCR through `ocr_with_baiduocr` without an explicit consent gate or just-in-time disclosure in the execution path. Marketing materials can contain unreleased campaigns, customer data, or regulated claims, so silent transmission to a third-party service creates a real privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes OCR text, rule hits, agent payloads, agent outputs, and reports to disk automatically, which can persist sensitive marketing content and extracted text beyond the user's expectations. If the output directory is shared, synced, or insufficiently protected, this creates an avoidable confidentiality and retention risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script base64-encodes the supplied image and transmits it to Baidu's remote OCR API, which can expose sensitive marketing drafts, customer data, or regulated content to a third party without an explicit user-facing disclosure or consent step. In a review skill that may process proprietary creatives and screenshots, silent external transfer materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The launcher silently loads credentials from several common dotenv locations and propagates them into downstream subprocesses. Even if only OCR-related secrets are intended, broad environment propagation increases the chance of accidental secret exposure to child processes, logs, exceptions, or future code changes, and the user is not warned at execution time.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

parser.add_argument("--live", action="store_true", help="与 --self-check 搭配，实际调用一次百度 OCR")
    args, passthrough = parser.parse_known_args()

    env = os.environ.copy()
    env.pop("__PYVENV_LAUNCHER__", None)
    loaded_env_files = load_dotenv_files(env)
    python_bin = choose_python()

• Confidence: 93% confidence
• Finding: os.environ.copy()

Credential Access

High

• Category: Privilege Escalation

Content

def load_dotenv_files(env):
    candidates = [
        Path.cwd() / ".env",
        SKILL_DIR / ".env",
        Path.home() / ".openclaw" / ".env",
        Path.home() / ".config" / "openclaw" / "gateway.env",

• Confidence: 88% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

candidates = [
        Path.cwd() / ".env",
        SKILL_DIR / ".env",
        Path.home() / ".openclaw" / ".env",
        Path.home() / ".config" / "openclaw" / "gateway.env",
    ]
    loaded = []

• Confidence: 87% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

Path.cwd() / ".env",
        SKILL_DIR / ".env",
        Path.home() / ".openclaw" / ".env",
        Path.home() / ".config" / "openclaw" / "gateway.env",
    ]
    loaded = []
    for path in candidates:

• Confidence: 87% confidence
• Finding: .env"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

opencv-python
numpy
Pillow

• Confidence: 96% confidence
• Finding: opencv-python

Unpinned Dependencies

Low

• Category: Supply Chain

Content

opencv-python
numpy
Pillow

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

opencv-python
numpy
Pillow

• Confidence: 96% confidence
• Finding: Pillow

Known Vulnerable Dependency: opencv-python — 10 advisory(ies): CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +7 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: opencv-python

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: numpy

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: Pillow

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def _post_form(url, params, timeout):
    """Post form data as JSON response; fall back to curl if Python DNS fails."""
    import json
    import subprocess
    import urllib.parse

• Confidence: 70% confidence
• Finding: curl if Python DNS fails.""" import json import subprocess import urllib.parse import urllib.request import urllib.error body = urllib.parse.urlencode(params).encode('utf-8')

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.