Tesseract OCR Image Text Extraction

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.0.0

Overview

This OCR skill does what it claims, with no hidden data theft or destructive behavior found, but users should be careful with remote image URLs and dependency installation.

Install this only in an environment where npm dependency downloads are acceptable. Prefer local image files for private or regulated content, avoid remote image URLs unless the URL host is trusted, and consider pinning tesseract.js with a reviewed lockfile before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 39
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

shell

cd /root/.openclaw/workspace/skills/tesseract-ocr && npm init -y > /dev/null 2>&1 && npm install tesseract.js

Technical Analysis

The documented setup procedure installs tesseract.js without an exact version constraint, committed lockfile, or explicit integrity verification. The reviewed project contains neither a package.json nor a package lockfile that defines a reproducible, audited dependency graph.

As a result, npm install tesseract.js resolves whichever package version and transitive dependencies are available from the configured registry at installation time. The effective code installed and subsequently loaded by scripts/ocr.js can therefore change after the Skill has been reviewed. NPM package installation may also execute dependency lifecycle scripts with the privileges of the user performing the installation.

This is a supply-chain weakness rather than evidence that the current tesseract.js package is malicious.

Attack Path

1. An attacker compromises a future tesseract.js release, one of its transitive dependencies, or the package-resolution channel.
2. A user follows the setup command in SKILL.md.
3. NPM resolves and downloads the attacker-controlled version because no audited version or lockfile constrains resolution.
4. Malicious code may execute during an NPM lifecycle hook or when scripts/ocr.js imports tesseract.js.
5. The payload runs under the account that installed or invoked the Skill and can access resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the installing or invoking user. The potential scope includes reading or modifying files accessible to that account, accessing available environ ...[truncated 360 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a maintained package.json and package-lock.json to the project.
2. Pin tesseract.js to a specific, audited version rather than relying on the latest registry-selected release.
3. Install reproducibly with npm ci instead of generating package metadata and resolving dependencies at runtime.
4. Use npm ci --ignore-scripts if Tesseract.js and its dependency graph function without lifecycle scripts.
5. Review and update dependencies through a controlled process that includes vulnerability scanning, provenance checks, and lockfile review.
6. Verify registry configuration and package integrity, and avoid running installation as root. Use a dedicated, least-privileged account or isolated container.
7. Replace the documented command with a reproducible installation procedure, for example:

shell

cd /root/.openclaw/workspace/skills/tesseract-ocr
npm ci --ignore-scripts

This command should only be used after committing and reviewing the corresponding manifest and lockfile.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly supports OCR on image URLs but does not disclose the privacy and network implications of fetching remote images or downloading OCR language/model assets. This can cause users to unknowingly transmit sensitive image data or trigger outbound network access in environments where data egress is restricted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.