ClawHub
Back to skill

Security audit

百度文档解析unlimited-ocr-parser

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Baidu OCR client, but it needs review because it can send full documents or document URLs to Baidu and auto-fetch returned result links without clear consent, privacy, or URL-scoping guardrails.

Review before installing. Use this skill only when users explicitly agree that the document content or document URL may be sent to Baidu for OCR processing, and avoid confidential, regulated, or internal documents unless that data flow is approved. Prefer environment variables or a secret manager over plaintext agent config files, and consider disabling automatic result downloads or adding Baidu-domain URL validation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/apikey-fetch.md (reported line 29)May include surrounding context.

export BAIDU_DOC_AI_SECRET_KEY="your_actual_secret_key_here"

text

或通过配置文件 `~/.claude/settings.json`：

```json
{

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/error_codes.md (reported line 18)May include surrounding context.

md
| 18 | Open api qps request limit reached | QPS 超限 | 降低请求频率 |
| 19 | Open api total request limit reached | 总量配额超限 | 购买额外配额 |
| 100 | Invalid parameter | access_token 无效 | 重新获取 |
| 110 | Access token invalid or no longer valid | access_token 无效 | 重新获取（30 天有效期） |
| 111 | Access token expired | access_token 过期 | 重新获取 |

### 文件相关错误

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/error_codes.md (reported line 19)May include surrounding context.

md
| 18 | Open api qps request limit reached | QPS 超限 | 降低请求频率 |
| 19 | Open api total request limit reached | 总量配额超限 | 购买额外配额 |
| 100 | Invalid parameter | access_token 无效 | 重新获取 |
| 110 | Access token invalid or no longer valid | access_token 无效 | 重新获取（30 天有效期） |
| 111 | Access token expired | access_token 过期 | 重新获取 |

### 文件相关错误

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents use of environment variables and outbound network access to Baidu APIs, but it does not declare any explicit tool scope or permissions. That creates a transparency and governance gap: an agent may invoke external requests or read credentials without users and platform policy seeing a clear permission boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger terms are broad generic phrases like '文档解析', 'Markdown 解析', and '结构化文档', which can cause the skill to activate in situations beyond the user's clear intent. In this skill's context, over-broad activation is more dangerous because invocation may lead to external transmission of sensitive documents or URLs to a third-party cloud OCR service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes cloud OCR processing but does not prominently warn that uploaded document contents or referenced file URLs are sent to Baidu-operated external APIs. This omission can lead to unintentional disclosure of confidential files, internal URLs, personal data, or regulated documents to a third party, especially since the service also returns result URLs valid for 30 days.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide explicitly recommends placing long-lived API credentials into ~/.claude/settings.json, which stores secrets on disk without any warning about local compromise, backups, file permissions, or accidental sharing. While this is common documentation practice, it increases credential exposure risk if the workstation, home directory, logs, or config sync mechanisms are compromised.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apikey-fetch.md (reported line 49)May include surrounding context.

4. 验证配置

bash
curl -X POST 'https://aip.baidubce.com/oauth/2.0/token' \
  -d 'grant_type=client_credentials' \
  -d 'client_id={your_api_key}' \
  -d 'client_secret={your_secret_key}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation describes uploading files to Baidu OCR and returning result URLs valid for 30 days, but it does not warn users that documents are transmitted to and stored by a third-party external service. This can lead users to submit sensitive documents under incorrect privacy assumptions, increasing risk of unintended data exposure, retention, or compliance violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This skill sends document content or document URLs to a third-party cloud OCR service, but there is no explicit user-facing consent, warning, or data-handling disclosure in the code path. In a document-parsing skill, users may supply sensitive files, so silent transmission to an external provider creates a real privacy and compliance risk even if functionally intended.

Content

No source excerpt is available for this finding.

Tainted flow: 'markdown_url' from requests.post (line 149, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
89% confidence
Finding

The code trusts markdown_url returned by a prior network response and immediately performs requests.get on it without validating the scheme, host, or expected domain. If the upstream API, a MITM position, or a compromised service returns an attacker-controlled URL, this enables server-side request forgery behavior and unintended outbound requests from the environment running the skill.

Content

Scanner excerpt · scripts/baidu_doc_unlimited_ocr_parser.py (reported line 151)May include surrounding context.

python
if download_result:
                        markdown_url = result.get("result", {}).get("markdown_url")
                        if markdown_url:
                            md_resp = requests.get(markdown_url, timeout=60)
                            md_resp.encoding = "utf-8"
                            result["markdown"] = md_resp.text
                        parse_result_url = result.get("result", {}).get("parse_result_url")

Tainted flow: 'parse_result_url' from requests.post (line 154, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
89% confidence
Finding

parse_result_url is taken from untrusted network data and fetched directly, creating the same SSRF/open-fetch risk as with markdown_url. In addition, the response is parsed as JSON with broad exception suppression, which can hide malformed or malicious responses and make abuse harder to detect.

Content

Scanner excerpt · scripts/baidu_doc_unlimited_ocr_parser.py (reported line 157)May include surrounding context.

python
parse_result_url = result.get("result", {}).get("parse_result_url")
                        if parse_result_url:
                            try:
                                pr_resp = requests.get(parse_result_url, timeout=60)
                                pr_resp.encoding = "utf-8"
                                result["parse_result"] = pr_resp.json()
                            except Exception:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file presents the skill documentation entirely in Chinese, starting with a Chinese-only title, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file's natural-language content is entirely Chinese and does not indicate that the user can select another language or that the skill is intentionally limited to a Chinese-speaking audience for a documented reason. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The script automatically accesses BAIDU_DOC_AI_API_KEY and BAIDU_DOC_AI_SECRET_KEY from the environment to authenticate to the service. This is credential handling, but there is no visible warning or explanatory comment to inform users that environment-stored secrets will be consumed.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:130