ClawHub
Back to skill

Security audit

Ocr Local 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

The OCR tool appears purpose-aligned, but it needs review because it installs an unpinned npm package and makes first-run downloads despite strong local-only wording.

Review this before installing in sensitive environments. It is an OCR helper, but installation may execute npm package install behavior, and first use may download language data. Prefer a version that pins tesseract.js exactly, uses the committed lockfile, and clearly documents offline setup and cache locations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned npm Dependency Allows Supply-Chain Code Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

yaml
metadata: {"openclaw":{"emoji":"📝","requires":{"bins":["node"]},"install":[{"id":"npm","kind":"npm","packages":["tesseract.js"],"label":"Install tesseract.js"}]}}

Related dependency configuration in package.json:13-15:

json
"dependencies": {
  "tesseract.js": "^7.0.0"
},

The current lockfile records an installation script in package-lock.json:68-81:

json
"node_modules/tesseract.js": {
  "version": "7.0.0",
  "resolved": "https://registry.npmjs.org/tesseract.js/-/tesseract.js-7.0.0.tgz",
  "integrity": "sha512-exPBkd+z+wM1BuMkx/Bjv43OeLBxhL5kKWsz/9JY+DXcXdiBjiAch0V49QR3oAJqCaL5qURE0vx9Eo+G5YE7mA==",
  "hasInstallScript": true,
  "license": "Apache-2.0",
  "dependencies": {
    "bmp-js": "^0.1.0",
    "idb-keyval": "^6.2.0",
    "is-url": "^1.2.4",
    "node-fetch": "^2.6.9",
    "opencollective-postinstall": "^2.0.3",
    "regenerator-runtime": "^0.13.3",
    "tesseract.js-core": "^7.0.0",
    "wasm-feature-detect": "^1.8.0",
    "zlibjs": "^0.3.1"
  }
},

Technical Analysis

The Skill installation metadata requests tesseract.js without an exact version or integrity constraint. A Skill manager processing this metadata may resolve the latest package release rather than the version reviewed in this repository. Separately, the caret range in package.json permits compatible future releases.

npm packages can execute lifecycle scripts during installation. The reviewed lockfile explicitly marks the currently resolved tesseract.js package as having an installation script. Therefore, if a future permitted release or its transitive dependency is compromised, installation can execute attacker-controlled code under the identity of the user or Agent installing the Skill.

The rep ...[truncated 1620 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the Skill metadata dependency to the exact reviewed release:

    yaml
    metadata: {"openclaw":{"emoji":"📝","requires":{"bins":["node"]},"install":[{"id":"npm","kind":"npm","packages":["tesseract.js@7.0.0"],"label":"Install tesseract.js"}]}}

  2. Replace the caret range in package.json with an exact version:

    json
    "dependencies": {
  "tesseract.js": "7.0.0"
}

  3. Require deterministic installation through npm ci and the committed package-lock.json, ensuring that package versions and integrity hashes are enforced.

  4. Review lifecycle scripts before dependency updates. Where operationally compatible, install with lifecycle scripts disabled and explicitly perform only the required trusted setup.

  5. Use automated dependency monitoring and require security review for lockfile changes, newly introduced transitive dependencies, and packages that execute installation scripts.

  6. Perform dependency installation in a sandbox with minimal filesystem access, no unnecessary credentials, and no elevated operating-system privileges.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file presents the skill’s publishing checklist and instructions in Chinese only, beginning with a Chinese title, while also describing an OCR skill for both Chinese and English recognition. Under the policy for natural-language violations, forcing a specific language without user opt-in or a documented region-specific reason is a reportable issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill manifest describes the capability as fully local and requiring no external service, but this file explicitly says language data is automatically downloaded at runtime and that first use downloads about 20MB per language. That means the skill performs network access as part of operation, which is a meaningful behavior beyond a strict '100% local' description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises the OCR workflow as "100% local" and "no API key required," but elsewhere discloses that first run downloads language data. That mismatch can mislead users operating in restricted or air-gapped environments into triggering unexpected outbound network access, creating privacy, compliance, or supply-chain risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Saying the run is "100% local" while noting that first use downloads language data is a materially inconsistent security claim. In security-sensitive contexts, users may rely on the local-only representation and expose systems to unexpected egress or unreviewed external dependencies.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This manifest description explains what the skill does but provides no explicit trigger phrases, invocation constraints, or exclusion conditions. For manifest files, that ambiguity can contribute to unintended invocation because the activation scope is not clearly bounded.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
87% confidence
Finding

Using a caret version for a runtime dependency allows automatic adoption of future minor/patch releases, which can introduce supply-chain risk if an upstream release is compromised or contains a breaking security regression. Because this skill performs local OCR and depends on a substantial third-party package, dependency drift increases the attack surface even though no overtly malicious behavior is visible here.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"license": "MIT",
  "acceptLicenseTerms": true,
  "dependencies": {
    "tesseract.js": "^7.0.0"
  },
  "repository": {
    "type": "git",

Static analysis

No suspicious patterns detected.