Greek Document Ocr

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:33 PM UTC
• Version: 0.1.0

Overview

The skill is mostly a Greek OCR workflow, but it handles sensitive financial and government documents while giving inconsistent disclosures about cloud use, credentials, banking, email, and accounting integrations.

Review before installing. The local OCR portion is coherent, but only use the accounting, banking, email, cloud, or hybrid features after confirming exactly what data is sent, which credentials are needed, and whether each action requires explicit user approval. Avoid enabling integrations for client tax, banking, or government documents until those boundaries are documented.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Chaining Abuse

High

• Category: Tool Misuse

Content

# Install Tesseract OCR with Greek language support
sudo apt install tesseract-ocr tesseract-ocr-ell
which jq || sudo apt install jq

mkdir -p $OPENCLAW_DATA_DIR/ocr/{incoming/{scanned,photos,government},output/{text-extracted,structured-data}}
```

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This prompt explicitly requires processing a Greek invoice and the expectations reinforce a fixed Greek-language workflow. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the regional constraint is clearly justified.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The prompt and expectations require Greek receipt processing and apply Greece-specific VAT deduction logic as a built-in assumption. Because the file does not explain that this is a region-specific compliance scenario, it reads as a fixed locale policy rather than an opt-in or documented exception.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This prompt directs the skill to process Greek business documents, including AADE forms, as an assumed default. That constitutes a locale-specific requirement in natural language, and the file does not explicitly frame it as a justified region-specific evaluation scope.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The manifest advertises optional QuickBooks/Xero export and direct push features despite describing the skill as local OCR with no cloud APIs. This scope expansion creates a risk that sensitive extracted accounting data may be transmitted to third-party platforms without the documentation making the boundary clear to users.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill describes Xero/QuickBooks export capabilities for OCR results but provides no privacy or transmission warning. Because the processed content includes invoices, receipts, and government documents, omission of external-sharing disclosures can lead to unintentional transfer of sensitive business and personal data.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

export OPENCLAW_DATA_DIR="/data"

# Install Tesseract OCR with Greek language support
sudo apt install tesseract-ocr tesseract-ocr-ell
which jq || sudo apt install jq

mkdir -p $OPENCLAW_DATA_DIR/ocr/{incoming/{scanned,photos,government},output/{text-extracted,structured-data}}

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Install Tesseract OCR with Greek language support
sudo apt install tesseract-ocr tesseract-ocr-ell
which jq || sudo apt install jq

mkdir -p $OPENCLAW_DATA_DIR/ocr/{incoming/{scanned,photos,government},output/{text-extracted,structured-data}}
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Direct banking transaction matching exceeds the stated scope of local OCR and expands access from document parsing into financial correlation workflows. That broader capability increases the chance of processing or exposing sensitive banking metadata without users understanding the additional trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill metadata and setup repeatedly claim all OCR processing is local and uses no cloud APIs, but later documentation advertises cloud and hybrid deployment modes that require internet access. This inconsistency can mislead operators into enabling external data transmission for sensitive invoices, receipts, and government documents under a false assumption of strictly local handling.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The coordinated workflow includes sending processing confirmations by email, which introduces outbound data sharing unrelated to core local OCR. For a skill handling financial and government documents, even confirmations can leak document presence, client identities, or extracted metadata to external systems without clear consent boundaries.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow says processing confirmations may be sent by email without explaining whether extracted document details, identities, or filenames are included. In the context of OCR on financial and government documents, that omission creates a real risk of accidental external disclosure.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The prompt hard-codes Greek document processing and mixed Greek/English handling. While likely legitimate for testing, the file does not explicitly justify the language restriction or indicate that the locale is selected by the user or document context.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The prompt directs generation of a report for a Greek accounting firm and repeatedly frames the workflow around Greek business context. Without an explicit note that this is a region-specific evaluation case, it can be read as forcing a locale-specific mode.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: The statement 'No credentials required' conflicts with the manifest's optional Xero API key for direct push integration. This can cause users to underestimate the presence of credentialed external integrations and mishandle secrets or enable features they did not realize required authentication.