OCR with python

• Analyzed: May 12, 2026, 4:31 AM
• Findings: 1
• Version: 1.0.0
• Hash: 472c0cf961448a4e677d0a3767aef5598b3a03dfa1e53c95ee89847c452d078a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides OCR functionality using standard libraries. However, the `scripts/ocr.py` script directly uses user-provided file paths for input (`file`) and output (`output`) without explicit sanitization. This creates a vulnerability where a malicious agent or user could potentially read or overwrite arbitrary files on the system by providing crafted paths (e.g., `/etc/passwd` or `../../sensitive.txt`). While this is a significant security risk (arbitrary file read/write), there is no clear evidence of intentional malicious behavior such as data exfiltration, backdoor installation, or prompt injection against the agent, thus classifying it as suspicious rather than malicious.