Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a Greek OCR workflow, but it handles sensitive financial and government documents while giving inconsistent disclosures about cloud use, credentials, banking, email, and accounting integrations.
Review before installing. The local OCR portion is coherent, but only use the accounting, banking, email, cloud, or hybrid features after confirming exactly what data is sent, which credentials are needed, and whether each action requires explicit user approval. Avoid enabling integrations for client tax, banking, or government documents until those boundaries are documented.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
sudo apt install tesseract-ocr tesseract-ocr-ell which jq || sudo apt install jq
mkdir -p $OPENCLAW_DATA_DIR/ocr/{incoming/{scanned,photos,government},output/{text-extracted,structured-data}}
Suspicious Unicode normalization or mixed-script content
This prompt explicitly requires processing a Greek invoice and the expectations reinforce a fixed Greek-language workflow. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the regional constraint is clearly justified.
The prompt and expectations require Greek receipt processing and apply Greece-specific VAT deduction logic as a built-in assumption. Because the file does not explain that this is a region-specific compliance scenario, it reads as a fixed locale policy rather than an opt-in or documented exception.
This prompt directs the skill to process Greek business documents, including AADE forms, as an assumed default. That constitutes a locale-specific requirement in natural language, and the file does not explicitly frame it as a justified region-specific evaluation scope.
The manifest advertises optional QuickBooks/Xero export and direct push features despite describing the skill as local OCR with no cloud APIs. This scope expansion creates a risk that sensitive extracted accounting data may be transmitted to third-party platforms without the documentation making the boundary clear to users.
The skill describes Xero/QuickBooks export capabilities for OCR results but provides no privacy or transmission warning. Because the processed content includes invoices, receipts, and government documents, omission of external-sharing disclosures can lead to unintentional transfer of sensitive business and personal data.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
export OPENCLAW_DATA_DIR="/data"
# Install Tesseract OCR with Greek language support
sudo apt install tesseract-ocr tesseract-ocr-ell
which jq || sudo apt install jq
mkdir -p $OPENCLAW_DATA_DIR/ocr/{incoming/{scanned,photos,government},output/{text-extracted,structured-data}}
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
sudo apt install tesseract-ocr tesseract-ocr-ell which jq || sudo apt install jq
mkdir -p $OPENCLAW_DATA_DIR/ocr/{incoming/{scanned,photos,government},output/{text-extracted,structured-data}}
Direct banking transaction matching exceeds the stated scope of local OCR and expands access from document parsing into financial correlation workflows. That broader capability increases the chance of processing or exposing sensitive banking metadata without users understanding the additional trust boundary.
The skill metadata and setup repeatedly claim all OCR processing is local and uses no cloud APIs, but later documentation advertises cloud and hybrid deployment modes that require internet access. This inconsistency can mislead operators into enabling external data transmission for sensitive invoices, receipts, and government documents under a false assumption of strictly local handling.
The coordinated workflow includes sending processing confirmations by email, which introduces outbound data sharing unrelated to core local OCR. For a skill handling financial and government documents, even confirmations can leak document presence, client identities, or extracted metadata to external systems without clear consent boundaries.
The workflow says processing confirmations may be sent by email without explaining whether extracted document details, identities, or filenames are included. In the context of OCR on financial and government documents, that omission creates a real risk of accidental external disclosure.
The prompt hard-codes Greek document processing and mixed Greek/English handling. While likely legitimate for testing, the file does not explicitly justify the language restriction or indicate that the locale is selected by the user or document context.
The prompt directs generation of a report for a Greek accounting firm and repeatedly frames the workflow around Greek business context. Without an explicit note that this is a region-specific evaluation case, it can be read as forcing a locale-specific mode.
The statement 'No credentials required' conflicts with the manifest's optional Xero API key for direct push integration. This can cause users to underestimate the presence of credentialed external integrations and mishandle secrets or enable features they did not realize required authentication.