Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward OCR helper that uploads user-selected documents to Mistral and can optionally send extracted images to Telegram, with no hidden persistence or automatic sharing found.
Install only if you are comfortable sending selected documents to Mistral for OCR. Use --send only when you intentionally want extracted images uploaded to Telegram, and avoid confidential, regulated, or third-party documents unless you have permission.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
)
try:
with urllib.request.urlopen(req, timeout=30) as resp:
result = _json.loads(resp.read())
if result.get("ok"):
print(f"Sent: {image_path}")
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
)
try:
with urllib.request.urlopen(req) as resp:
result = json.loads(resp.read())
except urllib.error.HTTPError as e:
print(f"API error {e.code}: {e.read().decode()}", file=sys.stderr)
The declared purpose focuses on OCR via Mistral, but the skill also supports sending extracted images to Telegram, which is a separate exfiltration path not reflected in the primary description or permissions. This mismatch can cause users or orchestrators to approve the skill for document reading while overlooking that sensitive document contents may be transmitted to an additional third-party service.
The README shows URL input usage without clearly warning that the referenced remote document content will be fetched and sent to Mistral's OCR API, a third-party service. Because this skill is specifically designed to process documents that often contain sensitive information, users may unknowingly upload private files or contents from internal links to an external provider.
The README promotes sending extracted document images to Telegram but does not warn that potentially sensitive document contents will be transmitted to a third-party messaging platform outside the local agent environment. In the context of OCR on receipts, invoices, contracts, and handwritten notes, this creates a realistic risk of unintentional disclosure of personal, financial, or confidential business information.
The skill uses sensitive capabilities including environment-variable access, local file reads, network access, and shell execution, but does not declare a tool scope or permissions boundary. That omission reduces transparency and weakens policy enforcement, making it easier for an agent or user to invoke the skill without understanding that documents and secrets may be accessed and transmitted externally.
The skill description and usage guidance do not clearly warn that document contents may be uploaded to Mistral for OCR and optionally forwarded to Telegram. For receipts, contracts, invoices, and handwritten notes, that omission is significant because these inputs commonly contain personal, financial, or confidential information.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
This skill reads `~/.openclaw/.env` as a fallback for credentials.
Ensure the file has restricted permissions: `chmod 600 ~/.openclaw/.env`
## Requirements
- Python 3.11+
The code reads Telegram credentials from environment variables and can send extracted document images to Telegram, but that behavior is not justified by the stated OCR-only purpose. In a document-processing context, this creates a meaningful risk of unintended disclosure of sensitive images derived from invoices, contracts, or personal records.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from pathlib import Path
API_KEY = os.environ.get("MISTRAL_API_KEY", "")
API_URL = "https://api.mistral.ai/v1/ocr"
def encode_file(path: str) -> str:
The skill description presents OCR extraction, but the code also includes a secondary capability to transmit extracted images to Telegram. That expands the data-handling scope from local processing plus OCR API use into optional redistribution of document-derived content to another third party, which can surprise users and increase confidentiality risk for receipts, contracts, or IDs.
The Telegram API endpoint enables outbound transmission of extracted images to a service unrelated to the skill’s stated OCR purpose. In the context of processing sensitive scanned documents, adding a second external sink materially increases the chance of unintended disclosure or misuse.
"""Send image as Telegram photo via Bot API (stdlib only)."""
import json as _json
url = f"https://api.telegram.org/bot{bot_token}/sendPhoto"
boundary = "----ClawDocScanBoundary"
ogg_path = Path(image_path)
The code base64-encodes local images or PDFs and sends the full document contents to the external Mistral OCR API. Because this skill targets potentially sensitive documents such as receipts, invoices, contracts, and handwritten notes, failing to provide a clear warning about third-party transmission increases privacy and compliance risk.
When --send is used, extracted images derived from the source document are transmitted to Telegram without an explicit warning at the moment of sending about third-party disclosure. Given the skill’s focus on scanned documents, this can expose sensitive embedded content outside the original OCR workflow.
No suspicious patterns detected.