Super Ocr

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:15 PM UTC
• Version: 0.1.0

Overview

This is a local OCR skill whose risks are mainly disclosed setup and dependency risks, not hidden or malicious behavior.

Install only in an environment where you are comfortable adding large OCR and image-processing dependencies. Prefer a virtual environment, pin and scan dependency versions, avoid running OCR on sensitive or untrusted images outside a sandbox, and be aware that setup commands may download packages and preprocessing may briefly write derived image files locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"       Command: {install_cmd}")
    
    try:
        result = subprocess.run(
            install_cmd.split(),
            capture_output=True,
            text=True,

• Confidence: 92% confidence
• Finding: This code can execute package installation commands via `pip`, causing the skill to modify the host environment and fetch code from external package sources. Even though the command strings are currently hardcoded, automatic dependency installation exceeds normal OCR functionality and creates supply-chain and environment-integrity risk if triggered in sensitive agent contexts.

Description-Behavior Mismatch

Low

• Confidence: 76% confidence
• Finding: The documentation presents the skill as a two-engine OCR selector but later advertises a third engine and an all-engines mode. This inconsistency can mislead users and reviewers about the skill's execution surface, causing them to underestimate external dependencies and OS-specific subprocess behavior.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The docs conflict on whether auto mode selects one optimal engine or runs all available engines. In a security context, that ambiguity matters because running all engines expands execution scope, increases attack surface, and may invoke more external components than the user intended.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: A dependency helper that installs packages at runtime gives the skill the ability to change the system state and introduce new executable code from package repositories. For an OCR skill, this is unnecessary during normal operation and increases the attack surface through supply-chain compromise, unexpected privilege context, and operational drift.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Documenting auto-install behavior without prominently warning that it may modify the system is risky because users may run setup commands expecting a read-only dependency check. Automatic package installation can change the environment, pull code from external sources, and introduce supply-chain exposure.

Missing User Warnings

Low

• Confidence: 75% confidence
• Finding: The preprocessing step writes a derived image file next to the original input, which can expose sensitive document contents to other local users, backups, scans, or unexpected persistence if cleanup fails. In an OCR skill handling potentially confidential images, undisclosed temporary disk writes increase data leakage risk even if the file is later deleted.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for Super OCR

# PaddleOCR (primary engine for Chinese, 98%+ accuracy)
paddleocr
paddlepaddle

# Tesseract (secondary engine for English, fast)

• Confidence: 96% confidence
• Finding: The dependency is unpinned, so installs may resolve to different versions over time, reducing build reproducibility and increasing supply-chain risk if a newly published version introduces malicious code or a breaking security regression. In an OCR skill that processes untrusted image content, dependency drift is especially risky because parser libraries sit close to attacker-controlled input.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# PaddleOCR (primary engine for Chinese, 98%+ accuracy)
paddleocr
paddlepaddle

# Tesseract (secondary engine for English, fast)
pytesseract

• Confidence: 98% confidence
• Finding: The unpinned paddlepaddle dependency allows unpredictable version resolution, which can silently introduce vulnerable or incompatible releases into production. Because PaddlePaddle is a large native/ML framework and this skill handles OCR on potentially untrusted documents, dependency volatility materially increases the attack surface.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

paddlepaddle

# Tesseract (secondary engine for English, fast)
pytesseract
pillow
opencv-python
numpy

• Confidence: 95% confidence
• Finding: Leaving pytesseract unpinned permits non-reproducible builds and exposure to newly introduced defects or supply-chain compromises. Even though pytesseract is a wrapper, OCR stacks often run on user-supplied files, so controlling exact versions is important for stable and secure deployments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Tesseract (secondary engine for English, fast)
pytesseract
pillow
opencv-python
numpy

• Confidence: 99% confidence
• Finding: An unpinned Pillow version is dangerous because Pillow parses complex, attacker-controlled image formats and has a long history of memory-safety and resource-consumption issues. In an OCR skill, image decoding is a primary entry point, so uncontrolled upgrades or accidental installation of vulnerable versions significantly increases risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Tesseract (secondary engine for English, fast)
pytesseract
pillow
opencv-python
numpy

# Optional: macOS Vision OCR

• Confidence: 99% confidence
• Finding: opencv-python is unpinned even though it is a complex native library that processes untrusted image data and has historically had memory corruption and parsing flaws. This makes the OCR skill more dangerous because malformed images can interact with vulnerabilities in exactly this component path.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pytesseract
pillow
opencv-python
numpy

# Optional: macOS Vision OCR
# pip install pyobjc  # macOS only

• Confidence: 94% confidence
• Finding: Unpinned numpy creates build non-determinism and can pull in versions with known defects or ABI incompatibilities that destabilize the OCR stack. While numpy is less directly exposed than image decoders, it is still part of a native-heavy dependency chain and should be controlled in production.

Known Vulnerable Dependency: paddlepaddle — 10 advisory(ies): CVE-2023-52313 (PaddlePaddle floating point exception in paddle.argmin and paddle.argmax); CVE-2022-46741 (PaddlePaddle Out-of-bounds Read vulnerability); CVE-2024-0818 (PaddlePaddle Path Traversal vulnerability) +7 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The requirements file includes paddlepaddle without a version constraint, and static analysis reports multiple known CVEs affecting that package family, including path traversal and memory-safety issues. In an OCR skill that may process untrusted files or model assets, vulnerable PaddlePaddle versions could allow file access, denial of service, or potentially deeper compromise depending on the specific flaw and deployment context.

Known Vulnerable Dependency: pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: Pillow is a high-risk dependency because it directly parses attacker-controlled image formats, and the finding cites numerous advisories including potential code execution and resource-exhaustion issues. Given that this skill's purpose is OCR on images, the skill context makes the dependency substantially more dangerous rather than less.

Known Vulnerable Dependency: opencv-python — 10 advisory(ies): CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: opencv-python is reported with multiple known vulnerabilities and is used on the direct path for image preprocessing, where malformed inputs can trigger parser or memory handling bugs. Because OCR services often accept arbitrary user images, exploitation could lead to crashes, information disclosure, or memory corruption in the processing environment.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The file includes numpy with no version, and the scanner associates the package with multiple historical advisories. The direct exploitability here is less obvious than for image-decoding libraries, but vulnerable native dependencies in the same OCR runtime can still contribute to denial of service or unsafe file interactions depending on the exact installed version and usage path.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.