ClawHub
Back to skill

Security audit

birth_medical_cert_ocr

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate OCR purpose, but it uploads highly sensitive birth-certificate documents and API credentials through a configurable network destination that is broader than the declared endpoint.

Review before installing. Only use this with birth medical certificate files you are authorized to process, because images leave the local machine for Scnet OCR. Do not customize SCNET_API_BASE unless you fully trust and verify the endpoint, and prefer environment/secret-store API key handling over a plaintext .env file.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/main.py:82
Finding

Configurable API Base URL Enables Credential and Sensitive Document Exfiltration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/main.py:115
Finding

Insufficient File Validation Allows Upload of Arbitrary Readable Local Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (20)

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The skill requests permission to read its local config/.env file containing the API key. Although this is likely needed for normal operation, granting file-read access to credentials increases the blast radius if the script is compromised, modified, or reused in unintended ways; the skill also processes sensitive PII, so credential misuse could enable unauthorized API usage or abuse under the user's account.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
permissions:
  read_local_files:
    paths:
      - "${SKILL_ROOT}/config/.env"
      - "${USER_PROVIDED_FILE_PATH}"
    reason: 读取用户提供的出生医学证明图片文件及本地配置文件。
  network:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/main.py (reported line 20)May include surrounding context.

python
# 获取技能根目录（脚本所在目录的上一级）
SKILL_ROOT = Path(__file__).parent.parent.absolute()
ENV_FILE = SKILL_ROOT / "config" / ".env"

# --- 新增：重试配置 ---
MAX_RETRIES = 3            # 最大重试次数

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
def load_config():
    """从 .env 文件加载配置，若文件不存在则抛出友好错误"""
    if not ENV_FILE.exists():
        error_msg = (
            "\n===============================================\n"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md
def load_config():
    """从 .env 文件加载配置，若文件不存在则抛出友好错误"""
    if not ENV_FILE.exists():
        error_msg = (
            "\n===============================================\n"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/main.py (reported line 33)May include surrounding context.

python
def load_config():
    """从 .env 文件加载配置，若文件不存在则抛出友好错误"""
    if not ENV_FILE.exists():
        error_msg = (
            "\n===============================================\n"

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill requests read access to ${SKILL_ROOT}/config/.env, which commonly stores secrets such as API keys. Granting a skill file-read access to a local .env is broader than necessary for normal credential injection and creates a path for secret exposure, especially when the same skill also has network egress to an external service. In this context, access to highly sensitive user documents plus local secrets materially increases blast radius.

Content

Scanner excerpt · skill.yaml (reported line 24)May include surrounding context.

yaml
permissions:
  read_local_files:
    paths:
      - "${SKILL_ROOT}/config/.env"
      - "${USER_PROVIDED_FILE_PATH}"
    reason: 读取用户提供的出生医学证明图片文件及本地配置文件。
  network:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The substantive skill instructions, warnings, prerequisites, and usage guidance are presented entirely in Chinese in the main operational section of the README. This creates a natural-language locale constraint without user opt-in or an explicit justification that the skill is intended only for Chinese-speaking or region-specific users.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The README explicitly instructs users to send birth certificate images containing extremely sensitive personal and medical data to a third-party API endpoint. Even though the data flow is disclosed, external transmission of highly sensitive documents materially increases privacy, compliance, and exposure risk if the service, transport, retention policy, or API key handling is weak or misconfigured.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

ini
SCNET_API_KEY=your_scnet_api_key_here
SCNET_API_BASE=https://api.scnet.cn/api/llm/v1
  1. 运行识别：

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

md
* [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/)
* [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/)
* [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html)
* [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/)
* [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The skill explicitly uploads user-provided birth medical certificate images to a third-party OCR endpoint. These documents contain highly sensitive personal and medical data for infants and parents, so external transmission creates real confidentiality and compliance risk if consent, minimization, retention, or vendor controls are inadequate. The skill context makes this more dangerous because the data class is unusually sensitive and identity-related.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
reason: 读取用户提供的出生医学证明图片文件及本地配置文件。
  network:
    endpoints:
      - "https://api.scnet.cn/api/llm/v1/ocr/recognize"
    reason: 将出生医学证明图片上传至 Scnet OCR 服务进行识别处理。
  execute_script:
    command: "python3 ${SKILL_ROOT}/scripts/main.py BIRTH_CERTIFICATE <filePath>"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
# Sugon-Scnet OCR API 文档摘要

## 接口地址
`POST https://api.scnet.cn/api/llm/v1/ocr/recognize`

## 请求头
- `Content-Type: multipart/form-data`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md
# Sugon-Scnet OCR API 文档摘要

## 接口地址
`POST https://api.scnet.cn/api/llm/v1/ocr/recognize`

## 请求头
- `Content-Type: multipart/form-data`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-docs.md (reported line 4)May include surrounding context.

md
# Sugon-Scnet OCR API 文档摘要

## 接口地址
`POST https://api.scnet.cn/api/llm/v1/ocr/recognize`

## 请求头
- `Content-Type: multipart/form-data`

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/main.py (reported line 49)May include surrounding context.

python
"   b) 配置文件：\n"
            f"      mkdir -p {SKILL_ROOT}/config\n"
            f"      echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n"
            f"      chmod 600 {ENV_FILE}\n"
            "\n配置完成后重新运行。"
        )
        sys.exit(error_msg)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/main.py (reported line 185)May include surrounding context.

python
"   b) 配置文件：\n"
            f"      mkdir -p {SKILL_ROOT}/config\n"
            f"      echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n"
            f"      chmod 600 {ENV_FILE}\n"
            "\n配置完成后重新运行。"
        )
        sys.exit(error_msg)

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill is hardwired to transmit documents to an external service endpoint, creating an external data egress path. In the context of birth-certificate OCR, this is especially sensitive because the uploaded files likely contain protected personal and medical information, so any unintended or insufficiently disclosed transmission materially increases privacy exposure.

Content

Scanner excerpt · scripts/main.py (reported line 82)May include surrounding context.

python
)
        sys.exit(error_msg)

    config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1')
    return config

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends the user-supplied file to a third-party OCR API, which means potentially sensitive personal data from birth certificates is transmitted off-host. In this skill context, the document contains highly sensitive PII, and the script does not present an explicit runtime consent notice or data-handling warning before upload, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The skill explicitly transmits a user-provided birth medical certificate image to an external OCR API. This document contains highly sensitive personal data about a newborn and parents, so external transmission creates real privacy, compliance, and data-handling risk even if it is the intended function. The narrow document-specific purpose lowers suspicion of maliciousness, but the sensitivity of the data makes the exposure significant.

Content

Scanner excerpt · skill.yaml (reported line 29)May include surrounding context.

yaml
reason: 读取用户提供的出生医学证明图片文件及本地配置文件。
  network:
    endpoints:
      - "https://api.scnet.cn/api/llm/v1/ocr/recognize"
    reason: 将出生医学证明图片上传至 Scnet OCR 服务进行识别处理。
  execute_script:
    command: "python3 ${SKILL_ROOT}/scripts/main.py <ocrType> <filePath>"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents core skill documentation content in Chinese only, including the title and feature descriptions. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

All user-facing messages, usage text, and instructions in the file are written only in Chinese, and the script does not provide any mechanism for users to select another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.