Security audit

Chinese Handwriting Ocr

Security checks for vulnerabilities and agentic risk

Overview

This appears to be an OCR toolkit, but its documentation does not accurately match its actual engines and it can persist extracted document text without clear enough disclosure.

Review before installing. Use this only in an isolated environment and controlled directories, especially for sensitive PDFs, because it may install mutable ML dependencies, render pages to temporary image files, and write extracted text into PDFs, TXT files, annotations, logs, or training outputs. Expect some documented commands and engine choices to fail or behave differently than advertised.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:37
Finding: Unpinned Third-Party Dependencies Create a Mutable Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
paddleocr== paddlepaddle== onnxruntime-gpu== ``` 2. Generate and commit a dependency lockfile that includes transitive dependencies. 3. Require package hashes by using a hash-locked requirements file and installation with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Explicitly specify and document the trusted package index. Avoid falling back to untrusted supplemental indexes. 5. Record model artifact URLs, versions, expected file sizes, and SHA-256 checksums. 6. Verify model checksums before loading downloaded artifacts. 7. Prefer vendored or internally mirrored model files when processing sensitive documents. 8. Install dependencies in an isolated virtual environment or container under a non-privileged account. 9. Add automated dependency vulnerability and provenance checks to the release process. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ocr_date_extractor.py:23
Finding: Predictable Temporary Image Paths Permit File Clobbering, Race Conditions, and Sensitive-Data Residue
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill is an OCR capability using PaddleOCR and RapidOCR to recognize Chinese text/handwriting. However, the supplied code is a data generation utility: it creates random date strings, renders them into handwritten-style images using Handright or PIL, writes those images to disk, and produces train/eval TSV files for CnOCR training. There is no OCR recognition, no document processing, no engine switching, and no use of PaddleOCR or RapidOCR. This is a materially different primary purpose, so it is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is materially inaccurate about the core implementation: it says the dual-engine design is PaddleOCR + RapidOCR, with PaddleOCR as the main document OCR engine, but the code actually uses Tesseract through ocrmypdf plus RapidOCR. This is not a minor implementation detail; it changes the primary engine stack entirely. In addition, the code includes several extra capabilities not mentioned in the description, including batch processing of directories, extracting OCR results to TXT, region-specific extraction, and embedding OCR output into PDFs via inserted text and annotations. The overall domain remains OCR, but the declared purpose does not accurately represent the actual code behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises a dual-engine Chinese OCR capability with PaddleOCR as the primary document OCR engine and RapidOCR for handwriting, implying broader OCR functionality and engine selection. The supplied code instead implements a specific handwritten date extraction workflow for PDFs: it renders PDF pages, runs RapidOCR only, searches for lines containing '月', extracts year/month/day patterns, applies heuristic corrections, and even infers missing dates from surrounding context. This is a materially different primary purpose and omits the advertised PaddleOCR/engine-switching behavior, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description claims a dual-engine Chinese OCR capability with PaddleOCR as the primary document OCR engine and RapidOCR for handwriting, implying both engines are present and selectable. However, the supplied code only imports and uses RapidOCR. There is no PaddleOCR usage, no engine-selection logic, and no broader dual-engine orchestration. The code does match part of the declared purpose—RapidOCR-based handwriting-oriented OCR—but materially underdelivers on the central advertised capability of having two OCR engines with flexible switching. The PDF region extraction, batch handling, and date parsing are consistent supporting behaviors, not separate concerns.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述强调的是一个通用的“双引擎中文OCR”能力，其中 PaddleOCR 为主、RapidOCR 为手写体补充，重点在引擎切换。但代码行为显示：1) load_engine 仅加载 RapidOCR，主流程 extract_dates_smart 中定位与识别也都直接实例化 RapidOCR；2) 注释甚至写明“RapidOCR(主力) + PaddleOCR(备选...)”，与声明相反；3) 核心逻辑集中在日期行检测、多次截图OCR、置信度投票、年份/月日纠偏及批量一致性校验，属于专用日期抽取与修正，而非通用OCR引擎包装层；4) 代码接收PDF路径并使用 fitz 渲染页面，说明资源和用途是PDF日期字段处理。虽然整体仍属于OCR相关功能，但其主要目的、引擎角色分配和实际能力范围与声明存在实质偏差，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a dual-engine Chinese OCR capability built around PaddleOCR and RapidOCR, implying inference-time OCR with selectable engines for documents and handwriting. The supplied code instead defines and trains a standalone CRNN+CTC neural network in PyTorch on synthetically generated date images containing only 0-9 and 年/月/日, validates it, and exports an ONNX model. This is a materially different primary purpose and implementation. While it is OCR-related in a broad sense, it does not match the claimed dual-engine PaddleOCR/RapidOCR functionality or general Chinese document OCR behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description presents an OCR runtime capability using two specific engines, PaddleOCR and RapidOCR, for Chinese OCR and handwriting specialization. The code chunk instead implements an offline model-development workflow: it synthesizes handwritten date data, prepares training files, fine-tunes a CnOCR number recognition model, and exports it to ONNX. This is a materially different primary purpose from a dual-engine OCR skill, and it uses a different OCR stack than declared. While handwriting recognition is loosely related to OCR, the actual behavior is training/export infrastructure rather than end-user OCR execution or engine switching.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README content is entirely in Chinese and does not provide an alternative language option or explain that the skill is intentionally region- or audience-specific. This can constitute a language/locale policy issue because it implicitly restricts accessibility without user opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes the skill as a dual-engine Chinese OCR capability that switches between PaddleOCR and RapidOCR as needed. However, the README also advertises training a custom CRNN model from scratch, which expands the skill from OCR inference into model development/training behavior not reflected in the stated description.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The skill name and description are explicitly Chinese-focused and the documentation is entirely in Chinese, but there is no indication that users can opt into another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill advertises batch OCR and JSON file output for document processing but does not warn users that extracted text may contain sensitive personal or business information and may be persisted to disk. In an OCR context, silent file output increases the chance of accidental data exposure through shared directories, logs, backups, or downstream tooling.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The supplied skill context says the skill is 'PaddleOCR(主力文档OCR) + RapidOCR(手写体特化)，按需灵活切换', implying two OCR backends and dynamic selection. However, the actual manifest content in this file says only '中文手写体OCR引擎', which narrows the scope to a single generic handwriting OCR engine and does not support the claimed dual-engine/document-OCR behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description is written only in Chinese ("中文手写体OCR引擎"), which indicates the skill is presented in a specific language without offering a user language choice or documenting a justified locale restriction. This is a natural-language policy concern because it may exclude users who do not read Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document title and the entire skill content are presented only in Chinese, which imposes a language choice on the user without any stated opt-in or alternative. Under the policy, natural-language instructions that force a specific language or locale without user choice should be flagged.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file's docstrings and generated date format are written exclusively in Chinese and the sample generation hard-codes the locale-specific format '%Y年%m月%d日'. This imposes a specific language/locale behavior without any opt-in, alternative locale support, or documented justification that the skill is intended only for a Chinese-language use case.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill manifest describes a Chinese OCR dual-engine skill built around PaddleOCR for document OCR and RapidOCR for handwriting specialization. This file's top-level documentation and implementation instead use Tesseract via ocrmypdf as the primary engine, with no PaddleOCR code present, creating a clear mismatch between the advertised engine behavior and the actual code.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The docstring describes dual-engine behavior as '先Tesseract,低置信度fallback', implying RapidOCR is invoked only when Tesseract confidence is low. In reality, ocr_dual always runs Tesseract and then always performs an additional RapidOCR pass over a fixed page region, with no Tesseract confidence check or conditional fallback logic.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/ocr_batch.py (reported line 17)May include surrounding context.
python
def ensure_tesseract(): try: import subprocess subprocess.run(["ocrmypdf", "--version"], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) except Exception: raise RuntimeError(

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/ocr_batch.py (reported line 29)May include surrounding context.
python
import subprocess cmd = ["ocrmypdf", "-l", lang, "--force-ocr", str(input_pdf), str(output_pdf)] subprocess.run(cmd, check=True) logging.info(f"[Tesseract] {input_pdf.name} -> {output_pdf.name}") # ── 引擎: RapidOCR (手写体优化) ────────────────────────────

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code claims to embed OCR text as a text layer or metadata, but actually writes recognized document content into the PDF body and annotations. This matters because users may assume the output preserves privacy characteristics of OCR text layers, while in reality sensitive extracted text is explicitly stored in annotations and partially on-page, potentially exposing confidential content to downstream viewers, indexing tools, or document sharing workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Recognized document text is embedded into PDF annotations without clear disclosure or opt-in. In an OCR skill handling potentially sensitive handwritten or document content, this can silently persist extracted personal or confidential data in a form that may be exposed through PDF viewers, search, export, collaboration systems, or metadata/annotation inspection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script saves OCR results back to disk with doc.save(str(output_pdf)) and similarly writes text files later, which changes or creates output artifacts derived from user documents. Although there is logging, the logging is directed to a file rather than a visible user-facing disclosure, and the script does not present an explicit warning that it will create or overwrite output files and embed extracted text into PDFs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code initializes PaddleOCR with lang='ch', which forces a specific language/locale behavior. This is a natural-language policy concern because the file provides no user opt-in, fallback, or documentation indicating that the skill is intentionally limited to Chinese-only OCR.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.