ClawHub
Back to skill

Security audit

Online Deepseek-OCR

Security checks for vulnerabilities and agentic risk

Overview

This cloud OCR skill does what it says, but it needs review because its configurable API endpoint can receive both submitted images and the API key.

Install only if you are comfortable uploading OCR images to SiliconFlow or the configured API host. Do not process IDs, financial records, credentials, private screenshots, or regulated data unless third-party cloud processing is approved. Verify config.json before each use, keep the API key protected, and prefer a version that validates the API host and pins dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ocr.py:172
Finding

Configurable API Endpoint Enables Disclosure of API Credentials and OCR Image Data

Content
View full analysis

Vulnerability Details

File Location: scripts/ocr.py:172-173, 229-230, 271-276, 285-290
Vulnerability Type: Unrestricted transmission of credentials and sensitive image data to a configurable endpoint
Risk Level: Medium

Vulnerable Code

python
self.api_key = self.config.get("apiKey", "").strip()
self.base_url = self.config.get("baseUrl", "https://api.siliconflow.cn/v1")
python
headers = {
    "Authorization": f"Bearer {self.api_key}",
    "Content-Type": "application/json"
}
python
payload["messages"] = [
    {
        "role": "user",
        "content": [
            {
                "type": "image_url",
                "image_url": {"url": f"data:image/png;base64,{image_data}"}
            },
            {
                "type": "text",
                "text": ocr_prompt
            }
        ]
    }
]
python
response = requests.post(
    f"{self.base_url}/chat/completions",
    headers=headers,
    json=payload,
    timeout=60
)

Technical Analysis

The API endpoint is read directly from config.json without validating its scheme or hostname. The same request sends the SiliconFlow API key in the Authorization header and the OCR input image in the JSON body.

For local images, base64 encoding is a normal transport mechanism required by the declared cloud OCR workflow. It is not encryption and does not protect the image from the request recipient. The encoding behavior is not, by itself, evidence of a covert exfiltration channel. The security issue is that the encoded image and bearer credential can be transmitted to any endpoint selected through baseUrl.

An attacker who can modify the skill configuration could set baseUrl to an attacker-controlled HTTPS server. The implementation would then treat that server as trusted and disclose both the API key and the processed document. Although configuration modification ...[truncated 1503 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove baseUrl configurability if only SiliconFlow is supported, and hardcode the reviewed HTTPS endpoint.
  2. If custom endpoints are a required feature, validate the URL before sending any request:
    • Require the https scheme.
    • Use an explicit hostname allowlist.
    • Reject embedded credentials, unexpected ports, IP literals, and deceptive subdomains.
    • Normalize and parse the URL with a standard URL parser before comparison.
  3. Never attach the SiliconFlow API key when the destination origin differs from the trusted SiliconFlow origin.
  4. Separate credentials by provider or endpoint instead of reusing one bearer token for arbitrary destinations.
  5. Protect config.json with restrictive file permissions and document that it contains a secret.
  6. Warn users clearly that cloud OCR uploads image contents to a third-party service.
  7. Add automated tests confirming that untrusted schemes and hosts are rejected before request construction.
  8. Consider obtaining the API key from a protected secret store or environment variable rather than a project-local JSON file.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependencies Create Non-Reproducible and Supply-Chain-Exposed Installations

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-3
Vulnerability Type: Unbounded dependency resolution without integrity verification
Risk Level: Low

Vulnerable Code

text
requests>=2.28.0
Pillow>=9.0.0
numpy>=1.21.0

Technical Analysis

All dependencies use minimum-version constraints with no upper bounds, exact version pins, or package hashes. Each installation can therefore resolve to different future releases. This makes the environment non-reproducible and prevents the project from ensuring that the installed artifacts are the versions that were reviewed.

The package names are established packages and there is no evidence in the audited files of typosquatting, dependency confusion, or a currently malicious release. The risk arises because future compromised, vulnerable, or incompatible releases automatically satisfy these constraints. The installation instructions invoke pip install -r requirements.txt, so package installation can execute package build or installation logic with the privileges of the user performing installation.

Attack Path

  1. A future eligible package release or distribution artifact is compromised, malicious, or contains a serious vulnerability.
  2. A user follows the documented installation procedure and runs pip install -r requirements.txt.
  3. Pip selects the latest release satisfying the broad minimum-version constraint.
  4. The unreviewed package artifact is downloaded and installed without hash verification.
  5. Malicious installation logic may execute during installation, or vulnerable code may be loaded when the OCR script imports the package.
  6. The resulting impact occurs with the privileges of the installing user or the runtime service account.

Impact Assessment

If an eligible dependency or artifact is compromised, it could execute code, access files available to the user, read the OCR configuration and API key, inspect subm ...[truncated 310 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct and transitive dependency to reviewed versions using exact constraints.
  2. Generate a locked requirements file with a dependency-management tool such as pip-tools.
  3. Record cryptographic hashes for every permitted distribution and install with pip --require-hashes.
  4. Review and update pins through a controlled dependency-update process rather than resolving unrestricted future releases during deployment.
  5. Run vulnerability and provenance checks in CI before accepting dependency updates.
  6. Prefer binary wheels from trusted package indexes and disallow unexpected alternate indexes or dependency links.
  7. Install and run the skill in an isolated, least-privileged virtual environment or container.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This is a real privacy/security issue because the skill explicitly performs cloud OCR using a third-party API, but the description does not clearly warn users that their images and extracted text are transmitted off-device to SiliconFlow. Users may submit screenshots, IDs, credentials, or other sensitive content under the assumption that processing is local, which increases the risk of unintended data disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.json (reported line 3)May include surrounding context.

json
# 提取配置值
        self.api_key = self.config.get("apiKey", "").strip()
        self.base_url = self.config.get("baseUrl", "https://api.siliconflow.cn/v1")
        self.model = self.config.get("model", "deepseek-ai/DeepSeek-OCR")
        
        # 初始化图像预处理器

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ocr.py (reported line 183)May include surrounding context.

python
# 提取配置值
        self.api_key = self.config.get("apiKey", "").strip()
        self.base_url = self.config.get("baseUrl", "https://api.siliconflow.cn/v1")
        self.model = self.config.get("model", "deepseek-ai/DeepSeek-OCR")
        
        # 初始化图像预处理器

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code transmits either a user-supplied image URL or the full contents of a local image (after preprocessing and base64 encoding) to a third-party OCR API, but it provides no explicit notice, consent prompt, or privacy warning at the point of use. This is dangerous because users may unintentionally upload sensitive documents, IDs, receipts, or screenshots to an external service without understanding where their data is going or how it will be handled.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The requests.post call sends OCR payloads, including either remote image references or base64-encoded local image contents, to an external network endpoint. In this skill context, external transmission is expected for cloud OCR, but it still creates a real data-exfiltration/privacy risk if users process sensitive images or if the configured endpoint is changed to an untrusted service.

Content

Scanner excerpt · scripts/ocr.py (reported line 295)May include surrounding context.

python
max_retries = 5
        for attempt in range(max_retries):
            try:
                response = requests.post(
                    f"{self.base_url}/chat/completions",
                    headers=headers,
                    json=payload,

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency specification uses a lower-bound constraint (requests>=2.28.0) rather than pinning an exact version, which makes builds non-reproducible and can cause different environments to resolve to different releases. This increases supply-chain risk and makes it difficult to verify whether a deployed version includes known security fixes or newly introduced issues.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0
Pillow>=9.0.0
numpy>=1.21.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Requests has multiple known advisories, and because the manifest does not pin a specific version, it is impossible to verify from this file whether the installed release is affected or fixed. In this context, the danger is primarily uncertainty and reduced auditability rather than confirmed direct exploitation from the manifest alone.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Pillow is declared with a minimum version only (Pillow>=9.0.0), so installations may resolve to different versions over time. For a package with a history of image-parsing vulnerabilities, this weakens assurance that deployed environments are using a reviewed and patched release.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.28.0
Pillow>=9.0.0
numpy>=1.21.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Pillow has a notable history of vulnerabilities, including issues in image parsing and resource handling, and the unpinned manifest prevents determining whether deployments use a safe version. This makes the skill more exposed if it processes untrusted images, because vulnerable parser versions can be high-risk in downstream use.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The numpy dependency is not pinned to an exact version, which allows environment-dependent resolution and reduces reproducibility. While this file alone does not prove exploitation, unpinned dependencies are a real supply-chain weakness because they complicate vulnerability management and can unexpectedly introduce insecure versions or breaking behavior.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
requests>=2.28.0
Pillow>=9.0.0
numpy>=1.21.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Numpy has published advisories, and the absence of version pinning means the actual installed version cannot be verified from the manifest. Although this file does not demonstrate a direct exploitable path, it creates a supply-chain governance gap and may allow inconsistent or vulnerable versions across environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Natural-language strings throughout the file, including the module description, error messages, and CLI usage text, are presented only in Chinese. This imposes a language choice on users without any opt-in or alternative locale handling, which matches the policy category for forced language or locale behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.