T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:78- Finding
Arbitrary OCR Endpoint Can Receive API Credentials and Sensitive Financial Documents
- Content
View full analysis
- Remediation
View remediation
Security audit
Bank Draft Ocr
Security checks for vulnerabilities and agentic risk
Overview
The skill performs its advertised OCR function, but it uploads sensitive bank-draft files and the API credential to a configurable external endpoint without enough scoping or consent guidance.
Review before installing. Only use this with documents you are allowed to send to Scnet or another configured OCR endpoint, verify config/.env cannot be modified by others, avoid changing SCNET_API_BASE unless you fully trust the destination, and prefer an environment where uploads of bank-draft data are approved by your organization.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:70- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 获取技能根目录（脚本所在目录的上一级） SKILL_ROOT = Path(__file__).parent.parent.absolute() ENV_FILE = SKILL_ROOT / "config" / ".env" # --- 新增：重试配置 --- MAX_RETRIES = 3 # 最大重试次数
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md * [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/) * [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/) * [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html) * [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/) * [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documentation indicates capabilities to read local files, make outbound network requests to a third-party API, and execute a Python script, but it does not declare any explicit tool scope or permissions boundaries. This increases the risk of over-broad agent execution because the runtime may permit more access than users expect when the skill is auto-invoked.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This skill is designed to send document contents to an external API endpoint, which constitutes outbound transmission of potentially sensitive bank draft images and extracted financial information. In the context of a bank draft OCR skill, this is especially sensitive because the uploaded files may contain payment details, recipients, issuing banks, dates, and amounts, creating confidentiality and compliance risks if users are not clearly informed or if transmission is insufficiently constrained.
- Content
SCNET_API_KEY=your_scnet_api_key_here
API 基础地址（一般无需修改）
SCNET_API_BASE=https://api.scnet.cn/api/llm/v1
text 2. 添加：`SCNET_API_KEY=你的密钥` 3. 设置文件权限为 600（仅所有者可读写）
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation guidance is broad: the AI may trigger this skill based on description keywords and a natural-language request mentioning an image path, without clear exclusions, confirmation requirements, or constraints on sensitive documents. Because the skill processes local files and sends their contents to an external OCR service, vague triggering can cause unintended execution and accidental disclosure of sensitive financial data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The documented configurable API base reinforces that this skill transmits data off-host to an external endpoint. Allowing a configurable base URL without documenting restrictions can increase the risk of misdirection or accidental transmission of sensitive OCR input and results to an unintended server.
- Content
md | 变量名 | 默认值 | 说明 | |--------|--------|------| | SCNET_API_KEY | 必需 | Scnet API 密钥 | | SCNET_API_BASE | https://api.scnet.cn/api/llm/v1 | API 基础地址（一般无需修改） | ### 输出
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The documentation hardcodes an external OCR endpoint, which means uploaded bank drafts and related document contents are transmitted outside the local trust boundary to a third party. In the context of a bank draft OCR skill, this is especially sensitive because the transmitted files may contain financial instrument data, personal information, and embedded seals/stamps, so the external transmission materially raises confidentiality and compliance risk unless strongly governed.
- Content
md # Sugon-Scnet OCR API 文档摘要 ## 接口地址 `POST https://api.scnet.cn/api/llm/v1/ocr/recognize` ## 请求头 - `Content-Type: multipart/form-data`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document describes uploading images, PDFs, or compressed archives containing highly sensitive financial and identity documents to a third-party OCR endpoint, and the example response includes extracted PII such as name, address, birth date, and ID number. Because the skill is for bank draft OCR, the absence of any privacy notice, data handling constraints, retention policy, or user-consent guidance materially increases the risk of unauthorized disclosure, regulatory non-compliance, and accidental exfiltration of sensitive data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and all user-facing usage/error text are written only in Chinese, which effectively imposes a specific language on users. Under the policy, locale or language constraints should be optional or explicitly justified; this file does not provide an opt-in or state that the skill is region-specific.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python " b) 配置文件：\n" f" mkdir -p {SKILL_ROOT}/config\n" f" echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n" f" chmod 600 {ENV_FILE}\n" "\n配置完成后重新运行。" ) sys.exit(error_msg)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python " b) 配置文件：\n" f" mkdir -p {SKILL_ROOT}/config\n" f" echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n" f" chmod 600 {ENV_FILE}\n" "\n配置完成后重新运行。" ) sys.exit(error_msg)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The skill transmits user-supplied document contents and an API bearer token to an external third-party service at api.scnet.cn. Because the files being processed are bank drafts, this can expose highly sensitive financial and personal data outside the local environment; the risk is elevated by the skill's purpose, which inherently handles confidential documents.
- Content
python ) sys.exit(error_msg) config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1') return config def recognize_with_retry(ocr_type, file_path, config, retry_count=0):
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The changelog heading and entry are entirely in Chinese, which imposes a specific language on readers without any visible opt-in or explanation. Under the policy, language-specific content can be a violation when no user choice or justification is provided.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file appears to be a generic template and does not describe when or how the skill should be invoked. For a skill README, the absence of explicit trigger scope or constraints can lead to ambiguous activation expectations and unintended invocation behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language instructions and description are presented in Chinese throughout the file, but the skill does not state that Chinese is required, offer an alternative language, or ask for user opt-in. This can violate language or locale policy when users are not given a choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The file forces a single language presentation through all headings, notes, and examples, and does not indicate that Chinese is optional or required for a region-specific audience. Per the policy rule, a fixed language without opt-in can be a natural-language policy violation unless the locale constraint is explicit and justified.
- Content
Static analysis
No suspicious patterns detected.