Ca File Processor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:23 AM UTC
• Version: 1.0.3

Overview

The skill appears purpose-built for local financial document processing, but it can automatically process sensitive attachments and pass large raw document contents into the agent context without clear consent or minimization controls.

Review this skill before installing in any environment that handles real client records. Use it only with explicit user-initiated uploads, disable broad automatic attachment triggers, add redaction or summary-only defaults for PAN/GSTIN/account/payroll data, and update vulnerable or stale parsing dependencies before processing untrusted files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly overstates the skill’s functionality. The code only handles CSV files via process_csv(file_path), using pandas to parse delimited text and produce normalized records and summaries. It does not contain any logic for PDFs, Excel spreadsheets, images, OCR, or generic multi-format file detection. While it can identify some CSV document types (e.g., bank_statement, gst_export, payroll_export, tally_export) and detect certain relevant columns, that is much narrower than the declared purpose of processing all uploaded financial documents and extracting text/tables/key fields from PDFs, invoices, and scans. This is a material description-behavior mismatch in primary scope and supported file types.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose presents a general financial document processor for multiple file formats and document classes, including OCR-like handling of scanned images and PDFs plus extraction of key business fields. The supplied code is narrowly scoped to Excel ingestion only: it accepts .xlsx and .xls, reads worksheet rows, truncates large sheets, detects approximate CA document type by keyword matching, and produces summaries/previews. That is a subset of the declared functionality, but the missing non-Excel format support and missing field extraction are material, not incidental. No significant undeclared harmful or unrelated capability is present; the mismatch is primarily overclaiming breadth of file support and extraction features.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad document-processing skill for many file types commonly used by Indian CA firms, including PDFs, spreadsheets, CSVs, and images, with automatic detection and extraction of text, tables, and key fields. The supplied code is materially narrower: it is an image-only OCR pipeline for JPG/PNG/JPEG files. It uses Pillow preprocessing and Tesseract OCR, then regex extraction for fields like GSTIN, invoice number, date, amount, PAN, email, phone, and IFSC. While this does align with part of the description for scanned image documents, it does not implement PDF, Excel, or CSV handling, nor table extraction, and its triggers/metadata are image-specific. Therefore the description overstates the implemented capabilities enough to constitute a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a broad financial document processor for many file types commonly used by Indian CA firms. The supplied code is narrowly a PDF processor: it accepts a file path to a PDF, determines whether the PDF is text-based or scanned, extracts text, attempts table extraction for text PDFs, and applies OCR for scanned PDFs. This aligns only with a subset of the declared purpose. There is no implementation for Excel, CSV, JPG, or PNG handling, no generic uploaded-file type routing, and no structured extraction of financial key fields such as GSTIN, invoice numbers, totals, or dates. The embedded skill metadata also confirms PDF-only triggers and purpose. Therefore the declared description materially overstates the implemented capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a material description-behavior mismatch. The declared description presents this as a financial document processing skill that automatically extracts structured content and key fields from various document types. However, the supplied code chunk does not perform document analysis at all; its primary purpose is routing based on file extension to other modules. While those downstream modules may potentially do the extraction, this code alone only acts as a dispatcher. The trigger mismatch is secondary but present: the description lists conversational triggers, whereas the code metadata is centered on file events. Therefore the declared description overstates the actual behavior of the supplied code chunk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: Pillow==10.3.0 — 16 advisory(ies): CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat); CVE-2026-54060 (Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill processes untrusted PDFs and images uploaded by users, so pinning Pillow to a version with multiple known advisories materially increases risk. Image parsing libraries are directly exposed in this context, and crafted files could trigger denial of service, memory corruption, or code-execution-adjacent behaviors depending on the specific vulnerable code paths.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises and instructs execution of local file-processing scripts but does not declare an explicit tool scope such as file access permissions. In a skill that handles uploaded financial documents, undeclared file-read capability weakens least-privilege controls and can lead to broader-than-expected access to sensitive local files if the runtime grants implicit access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match many ordinary document-related requests, which can cause the skill to activate on unintended inputs. In this context, unintended invocation is more dangerous because the skill is designed to read sensitive financial, tax, and identity-bearing files, increasing the chance of unnecessary processing or disclosure of personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is explicitly aimed at highly sensitive financial and personal documents, yet the description does not clearly warn users about the nature of the data being processed or the need for caution. Missing data-sensitivity disclosure can lead users to provide PANs, GSTINs, bank statements, payroll, and tax records without informed consent or appropriate handling expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill that processes PDFs, Excel files, CSVs, JPGs, and PNGs and extracts text, tables, and key fields from many financial document types. This file only implements CSV ingestion and normalization via process_csv, with no handling for PDF, Excel, image, OCR, or generic file-type auto-detection, so the actual behavior does not match the broader stated skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly returns full parsed CSV contents and labels the output as passed into LLM context, which can expose sensitive financial and personal data such as bank transactions, payroll data, GST records, and account balances. In this skill context, that is more dangerous because the trigger is automatic file upload processing for CA/financial workflows, making bulk over-sharing to downstream models or logs likely without informed consent or minimization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly structures spreadsheet rows and previews into output that is passed to LLM context, and the supported use cases include highly sensitive financial and payroll records. That creates a real confidentiality risk because uploaded Excel contents may contain personal, tax, banking, or business data that is forwarded for model processing without any user-facing warning, minimization, or consent checkpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly designed to extract highly sensitive financial and personal identifiers such as GSTIN, PAN, IFSC, phone numbers, and invoice totals from uploaded documents, then return them in structured form. In this CA-document context, those fields are extremely privacy-sensitive, and the code provides no minimization, consent, masking, or user-facing disclosure before exposing them to the broader agent pipeline.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function returns the full OCR text in the "text" field and the metadata states the output is passed to LLM context, which can expose entire documents rather than only necessary fields. For invoices, Form 16s, cheques, and salary slips, this may include broad personal, financial, and tax information far beyond the user's immediate need, increasing privacy leakage and downstream prompt-injection/data-exposure risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · requirements.txt (reported line 22)May include surrounding context.

text

Dependencies:
    pip install pymupdf pdf2image pytesseract pillow
    sudo apt-get install tesseract-ocr tesseract-ocr-hin poppler-utils

Usage in OpenClaw skill config:
    skill_name: pdf_processor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · requirements.txt (reported line 23)May include surrounding context.

text

Dependencies:
    pip install pymupdf pdf2image pytesseract pillow
    sudo apt-get install tesseract-ocr tesseract-ocr-hin poppler-utils

Usage in OpenClaw skill config:
    skill_name: pdf_processor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/skill_image.py (reported line 15)May include surrounding context.

python

Dependencies:
    pip install pymupdf pdf2image pytesseract pillow
    sudo apt-get install tesseract-ocr tesseract-ocr-hin poppler-utils

Usage in OpenClaw skill config:
    skill_name: pdf_processor

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/skill_pdf.py (reported line 11)May include surrounding context.

python

Dependencies:
    pip install pymupdf pdf2image pytesseract pillow
    sudo apt-get install tesseract-ocr tesseract-ocr-hin poppler-utils

Usage in OpenClaw skill config:
    skill_name: pdf_processor

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly declares its output is passed into LLM context and returns full extracted text from highly sensitive financial PDFs such as bank statements, tax forms, and invoices. This creates a real privacy and data-governance risk because personally identifiable and financial information may be transmitted to downstream model context without minimization, consent, redaction, or a warning to the caller.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code file accepts a file path and immediately hands the file to a selected processing skill, which may read or further process user-provided content. There is no confirmation prompt, user-facing disclosure, or warning in this file about how uploaded files will be handled, despite the skill acting as the single entry point for all incoming files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list includes the phrase "any file received," which is overly broad and can cause the skill to auto-activate on attachments outside the user's intent. In a financial document-processing context, unintended invocation increases the chance of processing sensitive files such as bank statements, tax records, or invoices without sufficient user confirmation, expanding privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The comments instruct installation of Hindi and Marathi OCR language packs, which implies locale-specific language handling. In this file there is no accompanying statement that language selection is optional or limited to a justified regional use case, so it can be read as a fixed language/locale requirement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The top-level docstring says the skill is specifically tuned for Indian bank statement formats and CA firm data exports, but the code later explicitly detects additional document classes such as payroll_export and tally_export. This is not just missing detail in comments; the implementation advertises broader semantic handling than the opening documentation states.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file repeatedly states that the skill is specifically tuned for Indian bank statement formats and CA firm exports, which imposes a locale-specific focus in natural-language descriptions. There is no opt-in choice for locale handling or explicit documentation that this is a region-specific skill with constrained applicability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The OCR configuration fixes processing to "eng+hin", which is a language/locale constraint embedded in the skill. The file does not offer the user a language choice or clearly document this as an opt-in regional limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.