ClawHub
Back to skill

Security audit

Ocr Local Rose

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward OCR skill that runs Tesseract.js on user-provided images, with some supply-chain and first-run download caveats users should understand.

Install this only if you are comfortable with npm installing Tesseract.js and with the first OCR run downloading language model files. For stricter environments, pin and review the dependency versions, use a trusted registry and retained lockfile, and pre-download language data before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package-lock.json:88
Finding

Mutable Dependency Installation Executes Lifecycle Code from a Third-Party Registry

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:5, package.json:20-22, package-lock.json:16-17, package-lock.json:88-91, PUBLISH.md:27-30
Vulnerability Type: Supply-chain exposure through unpinned dependencies, a non-official package registry, and install-time script execution
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:5:

yaml
metadata: {"openclaw":{"emoji":"📝","requires":{"bins":["node"]},"install":[{"id":"npm","kind":"npm","packages":["tesseract.js"],"label":"Install tesseract.js"}]}}

The installer metadata requests tesseract.js without specifying an exact version.

package.json:20-22:

json
"dependencies": {
  "tesseract.js": "^5.1.1"
},

package-lock.json:16-17:

json
"resolved": "https://registry.npmmirror.com/bmp-js/-/bmp-js-0.1.0.tgz",
"integrity": "sha512-vHdS19CnY3hwiNdkaqk93DvjVLfbEcI8mys4UjuWrlX1haDmroo8o4xCzh4wD6DGV6HxRCyauwhHRqMTfERtjw==",

package-lock.json:88-91:

json
"node_modules/tesseract.js": {
  "version": "5.1.1",
  "resolved": "https://registry.npmmirror.com/tesseract.js/-/tesseract.js-5.1.1.tgz",
  "integrity": "sha512-lzVl/Ar3P3zhpUT31NjqeCo1f+D5+YfpZ5J62eo2S14QNVOmHBTtbchHm/YAbOOOzCegFnKf4B3Qih9LuldcYQ==",
  "hasInstallScript": true,

Technical Analysis

The Skill has three interacting supply-chain weaknesses:

  1. SKILL.md installs tesseract.js without a version constraint.
  2. package.json uses the mutable range ^5.1.1, allowing later compatible releases to be selected.
  3. The supplied lockfile resolves packages through registry.npmmirror.com, a third-party registry mirror, and records that tesseract.js has an installation lifecycle script.

Publication guidance also recommends removing the lockfile so users receive newer versions. Removing the lockfile eliminates deterministic transitive dependency resolution and causes package contents to depend on registry state at install ...[truncated 2348 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin tesseract.js to an exact reviewed version in both SKILL.md and package.json; do not use an unversioned install request or a caret range.
  2. Retain package-lock.json in published artifacts and use npm ci so installation fails rather than silently changing the dependency graph.
  3. Regenerate the lockfile using the official npm registry, https://registry.npmjs.org, after reviewing the selected package versions.
  4. Verify package provenance, integrity hashes, maintainers, lifecycle scripts, and transitive dependencies before release.
  5. Do not recommend lockfile removal in publication documentation. Document deterministic installation as a security requirement.
  6. Keep dependency versions consistent across SKILL.md, package.json, the lockfile, and publication documentation.
  7. Where operationally feasible, install with lifecycle scripts disabled using npm ci --ignore-scripts. If Tesseract.js requires an installation script, review that exact script and explicitly permit only the required installation behavior.
  8. Run dependency installation in a restricted environment with minimal filesystem permissions, no unnecessary secrets, and limited outbound network access.
  9. Add automated dependency scanning and lockfile validation to the release process.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The document title and the full operational guidance are written in Chinese, which effectively imposes a specific language on users reading the publishing instructions. The file does not indicate that Chinese is optional, provide an alternative language, or explain that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document markets the skill as '100% local' while also stating that language data is downloaded automatically at runtime. This creates a misleading trust boundary: users may assume there is no network activity, but first-run execution performs external downloads, which can affect privacy expectations, offline use, and supply-chain risk assessment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Claiming '纯本地运行' in the feature list while later noting mandatory first-run downloads is materially inconsistent. Users relying on strict local-only execution or controlled environments could install the skill under false assumptions, leading to unexpected outbound network access and weakened transparency around dependency retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file documents that the first run downloads Tesseract.js language data, but it does not explicitly warn users that executing the skill will initiate a network transfer. Because markdown files should disclose behaviors that may affect privacy or system integrity, the description should make the download behavior clearer as a user-facing warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises itself as '100% local' and only later notes that first use downloads OCR language data and caches it locally. This can mislead users and automated systems about network access and local writes, which matters in restricted or privacy-sensitive environments. The issue is primarily one of incomplete disclosure rather than direct code execution, but it weakens informed consent and trust boundaries.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency uses a caret range (^5.1.1), which permits automatic installation of newer minor and patch releases. This can introduce supply-chain risk if an upstream release is compromised or contains a breaking/security-relevant change, reducing build reproducibility for the OCR skill.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json
"license": "MIT",
  "acceptLicenseTerms": true,
  "dependencies": {
    "tesseract.js": "^5.1.1"
  },
  "repository": {
    "type": "git",

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script defaults to 'chi_sim+eng' when no --lang argument is provided, which imposes a specific language/locale choice rather than prompting the user or remaining neutral. This is reinforced by the usage/help text, making the language preference implicit instead of opt-in.

Content

No source excerpt is available for this finding.