jpocr

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:55 AM UTC
• Version: 1.0.0

Overview

This is a local OCR wrapper for Japanese text, with some quality and shell-hardening issues but no evidence of deception, exfiltration, persistence, or destructive behavior.

Install only if you are comfortable with a local script processing image files and writing OCR outputs under its output directory. Prefer paths without spaces or option-like segments until the wrapper is hardened, and verify the missing OCR implementation and dependencies before relying on it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ocr-cli.sh:26

Finding

Unquoted Argument Construction Allows Option Injection and Unsafe Path Handling

Content

View full analysis

Vulnerability Details

File Location: scripts/ocr-cli.sh, lines 26–37
Vulnerability Type: Argument injection through unquoted shell variable expansion
Risk Level: Medium

bash

if [ -d "$INPUT" ]; then
  SOURCE_ARG="--sourcedir $INPUT"
else
  SOURCE_ARG="--sourceimg $INPUT"
fi

VIZ_FLAG=""
[ -n "$VIZ" ] && VIZ_FLAG="--viz True"

"$VENV" "$OCR" $SOURCE_ARG --output "$OUTDIR" $VIZ_FLAG >/dev/null 2>&1

Technical Analysis

The script combines attacker-influenced INPUT data with an option name in the scalar SOURCE_ARG, then expands that variable without quotes when invoking the Python OCR program. Bash therefore applies word splitting and pathname expansion to its contents.

An input path containing whitespace can be converted into multiple Python arguments. Subsequent path components beginning with - or -- may consequently be interpreted by src/ocr.py as additional options rather than as part of the source path. The same unsafe scalar-expansion pattern is used for VIZ_FLAG.

This is argument injection, not direct shell-command injection: shell metacharacters stored in INPUT are not reparsed as shell syntax during ordinary parameter expansion. The exact security impact cannot be fully established because the audited artifact does not contain the referenced src/ocr.py. The artifact also lacks the expected .venv/bin/python executable, so the documented OCR workflow cannot run from the supplied files alone.

Attack Path

1. An attacker creates or supplies an image or directory whose path contains whitespace and option-like tokens.
2. An agent invokes scripts/ocr-cli.sh with that path.
3. The script embeds the path in SOURCE_ARG.
4. Unquoted expansion splits SOURCE_ARG into multiple command-line arguments and may perform pathname expansion.
5. The missing src/ocr.py implementation may interpret injected tokens as options and perform unintended behavior supported by its ...[truncated 676 chars]

Remediation

View remediation

Remediation Suggestions

Construct command arguments with Bash arrays so each value retains its intended argument boundary:

bash

if [ "$#" -lt 1 ]; then
  printf 'Usage: %s <image-or-directory> [--json] [--viz]\n' "$0" >&2
  exit 2
fi

INPUT="$1"
shift

if [ ! -e "$INPUT" ]; then
  printf 'Input does not exist: %s\n' "$INPUT" >&2
  exit 1
fi

if [ -d "$INPUT" ]; then
  source_args=(--sourcedir "$INPUT")
else
  source_args=(--sourceimg "$INPUT")
fi

viz_args=()
if [ -n "$VIZ" ]; then
  viz_args=(--viz True)
fi

"$VENV" "$OCR" \
  "${source_args[@]}" \
  --output "$OUTDIR" \
  "${viz_args[@]}" \
  >/dev/null 2>&1

Additionally:

• Validate the input path and reject unsupported input types before invoking Python.
• Reject unknown wrapper options instead of silently ignoring them.
• Verify that $VENV is executable and $OCR is a regular trusted file before execution.
• Avoid suppressing all diagnostics, or capture them in a controlled log, so parsing failures and security-relevant errors remain observable.
• Include and audit src/ocr.py and the dependency specification before distributing the skill as operational.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger description is broad enough to match generic OCR and text-extraction requests, including English and non-Japanese document scenarios, which can cause the skill to activate outside its intended niche. Over-broad activation is dangerous because it may route user content to an unintended tool, increasing the chance of incorrect handling, privacy exposure of uploaded images, or interference with a more appropriate skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code creates an output directory and later writes OCR results into it, but the script itself provides no confirmation prompt, print/log message, or inline warning that files will be created under the configured output path. For a code file, file-writing behavior is in scope when there is no visible disclosure in the code being reviewed.

Content

No source excerpt is available for this finding.