Security audit

wps-ocr

Security checks across malware telemetry and agentic risk

Overview

This OCR skill clearly discloses that it sends user-provided files or URLs to WPS/Kingsoft cloud for text extraction.

Install only if you are comfortable sending OCR inputs to WPS/Kingsoft servers at aiwrite.wps.cn. Use a dedicated WPS_OCR_ACCESS_KEY, protect any ~/.openclaw/env entry, and provide only the exact files or URLs you intend to share, especially for IDs, contracts, invoices, screenshots, or private links.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill metadata declares `WPS_OCR_CLIENT_SECRET` as the required environment variable, but the user-facing setup instructions tell operators to export `WPS_OCR_ACCESS_KEY` instead. This inconsistency can cause misconfiguration, failed authentication, and unsafe operator workarounds such as hardcoding secrets or repeatedly troubleshooting credential handling. In a security-sensitive skill, contradictory secret naming is a real documentation/configuration flaw because it increases the chance of improper secret management.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill accepts arbitrary remote URLs and forwards them to the WPS backend for fetching, which makes the backend perform network access on behalf of the caller. Even though the code includes URL validation, this still expands the trust boundary and can be abused for unintended third-party fetching, privacy leaks, or backend-side SSRF against the remote service if its own fetch protections are weaker than the client-side checks.

Vague Triggers

Medium

Confidence: 75% confidence
Finding: The invocation guidance uses broad phrases like 'What text is this?' and 'Extract text,' which are common user requests that could cause this skill to be selected automatically in many contexts. Because the skill uploads files to a third-party cloud service and accepts local paths with only file-type verification, overly broad triggering increases the chance of unintended data disclosure or use on sensitive files without sufficiently explicit user intent.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger conditions are broad natural-language examples like asking to extract text from an uploaded image, which can overlap with ordinary conversation and cause the skill to run without sufficiently explicit user intent. Because this skill uploads user-provided files to a third-party cloud service, accidental invocation can create unintended data exfiltration and privacy exposure. The context makes this more dangerous than a benign local-only utility because file contents are sent off-platform.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill transmits user-supplied file contents or URLs, along with an access credential, to an external OCR service without any explicit user-facing disclosure or consent mechanism. In a tool presented as a lightweight file parser, this can mislead users into sending sensitive local documents or remote targets to a third party, creating confidentiality and compliance risks.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.