Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Car Sales Invoice Ocr
v0.1.0支持从机动车销售发票中精准提取车架号（VIN码）、发动机号、厂牌型号、购车人信息、价税合计金额、完税凭证号等车辆专属字段。
⭐ 0· 57·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to extract vehicle-invoice fields and implements a client that uploads images to Sugon-Scnet OCR — that capability matches the stated purpose. However, registry metadata reported no required environment variables while config.json and SKILL.md require SCNET_API_KEY (and an API base). This metadata mismatch is an incoherence in packaging.
Instruction Scope
SKILL.md and scripts/main.py limit behavior to reading a local file, reading config/.env for SCNET_API_KEY and SCNET_API_BASE, and POSTing the file to https://api.scnet.cn/api/llm/v1/ocr/recognize. The instructions also explicitly suggest asking the AI to 'help configure' by providing the token in chat — that is outside pure runtime necessity (it encourages pasting a secret into conversation) and increases the chance of accidental token exposure.
Install Mechanism
No install spec or remote downloads; the skill is instruction+script only and does not fetch arbitrary code at install time. This is lower risk.
Credentials
The only credential required by the code is SCNET_API_KEY (and an optional SCNET_API_BASE) which is proportionate to an external OCR API client. But the registry metadata incorrectly listed 'Required env vars: none' while config.json and SKILL.md name SCNET_API_KEY — that mismatch should be resolved. Also be mindful that the skill will upload images containing PII (VIN, engine number, buyer info) to the external API.
Persistence & Privilege
The skill is not always-enabled and does not request unusual platform privileges. config.json declares network and filesystem usage which aligns with the script's behavior. The skill does not modify other skills or system-wide settings.
What to consider before installing
Before installing: (1) Confirm the packaging metadata — the registry claims no env vars but the code needs SCNET_API_KEY stored in config/.env; ask the publisher to fix this mismatch. (2) Understand that images (VINs, engine numbers, buyer data) will be uploaded to api.scnet.cn — only use if you trust that external service and it meets your privacy/compliance needs. (3) Prefer manual configuration of the API key in a local file rather than pasting it into AI chat (the SKILL.md suggests telling the AI your token, which can leak secrets). (4) Inspect the included scripts/main.py (it is short and performs only file existence checks and a multipart POST) and verify network/filesystem permissions are acceptable. (5) If you proceed, use a dedicated API key with limited scope and rotate it if needed, and verify the skill owner/source (source is 'unknown' here).Like a lobster shell, security has layers — review code before you run it.
latestvk97ajy8jnjv81aeqks8gt8ext583qn3e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.