ClawHub
Back to skill

Security audit

jpocr

Security checks for vulnerabilities and agentic risk

Overview

This is a local OCR wrapper for Japanese text, with some quality and shell-hardening issues but no evidence of deception, exfiltration, persistence, or destructive behavior.

Install only if you are comfortable with a local script processing image files and writing OCR outputs under its output directory. Prefer paths without spaces or option-like segments until the wrapper is hardened, and verify the missing OCR implementation and dependencies before relying on it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ocr-cli.sh:26
Finding
Unquoted Argument Construction Allows Option Injection and Unsafe Path Handling## Vulnerability Details **File Location**: `scripts/ocr-cli.sh`, lines 26–37 **Vulnerability Type**: Argument injection through unquoted shell variable expansion **Risk Level**: Medium ```bash if [ -d "$INPUT" ]; then SOURCE_ARG="--sourcedir $INPUT" else SOURCE_ARG="--sourceimg $INPUT" fi VIZ_FLAG="" [ -n "$VIZ" ] && VIZ_FLAG="--viz True" "$VENV" "$OCR" $SOURCE_ARG --output "$OUTDIR" $VIZ_FLAG >/dev/null 2>&1 ``` ### Technical Analysis The script combines attacker-influenced `INPUT` data with an option name in the scalar `SOURCE_ARG`, then expands that variable without quotes when invoking the Python OCR program. Bash therefore applies word splitting and pathname expansion to its contents. An input path containing whitespace can be converted into multiple Python arguments. Subsequent path components beginning with `-` or `--` may consequently be interpreted by `src/ocr.py` as additional options rather than as part of the source path. The same unsafe scalar-expansion pattern is used for `VIZ_FLAG`. This is argument injection, not direct shell-command injection: shell metacharacters stored in `INPUT` are not reparsed as shell syntax during ordinary parameter expansion. The exact security impact cannot be fully established because the audited artifact does not contain the referenced `src/ocr.py`. The artifact also lacks the expected `.venv/bin/python` executable, so the documented OCR workflow cannot run from the supplied files alone. ### Attack Path 1. An attacker creates or supplies an image or directory whose path contains whitespace and option-like tokens. 2. An agent invokes `scripts/ocr-cli.sh` with that path. 3. The script embeds the path in `SOURCE_ARG`. 4. Unquoted expansion splits `SOURCE_ARG` into multiple command-line arguments and may perform pathname expansion. 5. The missing `src/ocr.py` implementation may interpret injected tokens as options and perform unintended behavior supported by its ...[truncated 676 chars]
Remediation
## Remediation Suggestions Construct command arguments with Bash arrays so each value retains its intended argument boundary: ```bash if [ "$#" -lt 1 ]; then printf 'Usage: %s <image-or-directory> [--json] [--viz]\n' "$0" >&2 exit 2 fi INPUT="$1" shift if [ ! -e "$INPUT" ]; then printf 'Input does not exist: %s\n' "$INPUT" >&2 exit 1 fi if [ -d "$INPUT" ]; then source_args=(--sourcedir "$INPUT") else source_args=(--sourceimg "$INPUT") fi viz_args=() if [ -n "$VIZ" ]; then viz_args=(--viz True) fi "$VENV" "$OCR" \ "${source_args[@]}" \ --output "$OUTDIR" \ "${viz_args[@]}" \ >/dev/null 2>&1 ``` Additionally: - Validate the input path and reject unsupported input types before invoking Python. - Reject unknown wrapper options instead of silently ignoring them. - Verify that `$VENV` is executable and `$OCR` is a regular trusted file before execution. - Avoid suppressing all diagnostics, or capture them in a controlled log, so parsing failures and security-relevant errors remain observable. - Include and audit `src/ocr.py` and the dependency specification before distributing the skill as operational.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger description is broad enough to match generic OCR and text-extraction requests, including English and non-Japanese document scenarios, which can cause the skill to activate outside its intended niche. Over-broad activation is dangerous because it may route user content to an unintended tool, increasing the chance of incorrect handling, privacy exposure of uploaded images, or interference with a more appropriate skill.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This code creates an output directory and later writes OCR results into it, but the script itself provides no confirmation prompt, print/log message, or inline warning that files will be created under the configured output path. For a code file, file-writing behavior is in scope when there is no visible disclosure in the code being reviewed.

Static analysis

No suspicious patterns detected.