ifly-pdf-image-ocr

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:14 AM UTC
• Version: 1.0.0

Overview

This is a straightforward iFlytek cloud OCR skill, but users should understand that selected images or PDFs are sent to iFlytek for processing.

Install only if you are comfortable sending chosen images, PDFs, or PDF URLs to iFlytek's cloud OCR service. Avoid processing confidential legal, medical, financial, or proprietary documents unless your iFlytek account and data-handling terms are acceptable, and keep the API credentials and generated logs protected.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/image_ocr.py:69

Finding

Authentication Credential Material Exposed in Request URL

Content

View full analysis

", algorithm="hmac-sha256", ..., signature="" ``` This value is Base64-encoded and placed in the URL query string. Base64 is an encoding mechanism, not encryption, so any party that obtains the URL can decode the authorization value without a secret. URLs are frequently recorded by reverse proxies, HTTP debugging infrastructure, application-performance monitoring systems, exception handlers, server access logs, and network observability products. HTTPS protects the request while it is transmitted, but it does not prevent the complete URL from being recorded at endpoints or trusted intermediary infrastructure. The API secret itself is not directly included in the URL. Furthermore, the signature contains a date and may therefore have a limited replay window. These constraints limit the scope of exploitation, but they do not eliminate disclosure of the API key identifier or possible replay of captured signed requests. This behavio ...[truncated 1993 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code clearly supports image OCR: it reads an image file, base64-encodes it, submits it to an OCR endpoint, and prints or saves the recognized text. That aligns with the image OCR portion of the description. However, the declared purpose substantially expands scope to PDF recognition and PDF conversion use cases, including PDF to Word/Markdown. This code chunk contains no PDF parsing, no PDF upload handling, no conversion to Word, and no interface suggesting PDF inputs. The only accepted positional argument is an image path, and the payload field is explicitly 'image'. Therefore the description overstates the implemented capabilities in a material way.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code’s primary purpose is PDF OCR task submission and polling against the iFlytek PDF OCR API. That aligns with the PDF-recognition and PDF-to-Word/Markdown parts of the description. However, the description explicitly claims support for both image OCR and PDF OCR, while this code only processes PDFs and has no image input handling, image endpoints, or image OCR workflow. The extra claims about multilingual extraction and layout understanding may be properties of the backend service, but they are not demonstrated by this code chunk. Because a major declared capability—image OCR—is absent from the actual implementation shown, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill sends images, PDFs, and possibly URL-referenced documents to an external OCR service, but the description does not clearly disclose this data transfer. For OCR workflows, inputs commonly contain personal, legal, financial, or proprietary information, so lack of disclosure can lead to unintentional exfiltration of highly sensitive documents to a third party.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documentation advertises capabilities that require environment access, file writes, and network communication, but it does not declare any explicit tool scope or permissions boundaries. This increases the chance an agent invokes the skill with broader-than-expected privileges, making accidental exfiltration of OCR inputs, secrets, or output files more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation language is extremely broad ('any OCR tasks on images or PDFs'), which can cause the skill to trigger for many ordinary user requests without clear user intent to send files to a third-party OCR provider. In this context, broad routing is more dangerous because the skill processes sensitive documents and may upload local files or fetch public URLs over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The examples encourage saving OCR output and generating converted files without warning that the skill will create local artifacts containing extracted document contents. This can leave sensitive OCR text or converted documents persisted on disk unexpectedly, increasing exposure through other tools, backups, or multi-user environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The response examples and error-code help sections contain Chinese-only strings such as "成功", "任务创建成功", and Chinese troubleshooting text, while the rest of the document is primarily English. This creates an implicit language constraint without opt-in or explanation, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The requests.post call sends the OCR payload, including base64-encoded image contents and metadata, to an external service. Although external transmission is expected for a cloud OCR client and the endpoint uses HTTPS with HMAC-based authentication, it remains a genuine data exposure boundary because any sensitive document content is disclosed to a remote provider.

Content

Scanner excerpt · scripts/image_ocr.py (reported line 140)May include surrounding context.

python

auth_url = self._generate_auth_url()

        # Send request
        response = requests.post(
            auth_url,
            json=request_data,
            headers={"Content-Type": "application/json"},

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code uploads the full image contents to a third-party OCR endpoint, but the script provides no explicit disclosure, consent prompt, redaction guidance, or data-handling warning before transmitting potentially sensitive user documents. In an OCR skill, this behavior is functionally necessary, but it still creates a real privacy and compliance risk if users process IDs, financial records, medical documents, or other confidential images without understanding that data leaves the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code uploads user-supplied PDF content or passes a user-provided PDF URL to a third-party OCR endpoint without any explicit warning, consent flow, or privacy notice at the point of use. Because OCR inputs often contain sensitive documents, this can lead to unintended disclosure of confidential data to an external service and associated retention/compliance risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest frames this skill as an OCR and document-recognition capability for images/PDFs, but this script also accesses process environment variables to obtain external-service credentials. While this may be operationally necessary for the vendor API, credential harvesting from environment state is not part of the user-facing OCR purpose and is not declared in the manifest text.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.