Bank Card Ocr

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:31 PM UTC
• Version:
  1.0.6

Overview

This skill does the advertised bank-card OCR, but it uploads the selected card image to SCNet and should only be used with explicit approval.

Install only if you are comfortable sending selected bank-card images and extracted card details to SCNet. Use test or approved images where possible, protect the SCNET_API_KEY, verify the SCNet publisher/source, and require explicit confirmation before running OCR on real payment-card data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The auto-invocation guidance is broad enough that an agent may trigger the skill whenever a user mentions a bank card image path, without strong consent or exclusion rules. Because the skill uploads highly sensitive financial imagery to an external service, overly permissive triggering increases the risk of unintended data disclosure.

VirusTotal

65/65 vendors flagged this skill as clean.