ClawHub
Back to skill

Security audit

commercial_invoice_ocr

Security checks across malware telemetry and agentic risk

Overview

This invoice OCR skill is purpose-aligned, but it uploads potentially sensitive invoice files to a third-party OCR API without a strong user-confirmation or privacy boundary.

Install only if you are comfortable sending selected commercial invoice files to Scnet's external OCR service. Use a dedicated API key, restrict access to config/.env, avoid submitting confidential or regulated documents without vendor approval, and confirm each file path before invoking the skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documentation indicates capabilities to read local files, invoke Python from the shell, and send data over the network, but it does not declare corresponding permissions or boundaries. This creates a transparency and policy-enforcement gap: users or orchestration systems may invoke the skill without realizing local files and document contents will be transmitted externally.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The auto-trigger guidance is broad enough that an assistant could invoke the skill whenever a user mentions invoice image recognition, without a clear confirmation step. Because the skill reads a local file path and sends document contents to a third-party OCR API, ambiguous triggering can lead to unintended exfiltration of sensitive business documents.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The documentation does not clearly warn that local file contents and associated invoice data are sent to an external OCR provider. Commercial invoices often contain sensitive business, customer, pricing, and shipping information, so lack of disclosure undermines informed consent and increases data leakage risk.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The manifest requires an API credential and strongly implies that invoice contents will be sent to an external SCNet service, yet it does not warn users that sensitive document data may leave the local environment. Because commercial invoices often contain company identities, pricing, invoice numbers, and trade terms, undisclosed external transmission creates a meaningful confidentiality and compliance risk.

External Transmission

Medium
Category
Data Exfiltration
Content
| 变量名 | 默认值 | 说明 |
|--------|--------|------|
| SCNET_API_KEY | 必需 | Scnet API 密钥 |
| SCNET_API_BASE | https://api.scnet.cn/api/llm/v1 | API 基础地址（一般无需修改） |

### 输出
Confidence
93% confidence
Finding
https://api.scnet.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
# Sugon-Scnet OCR API 文档摘要

## 接口地址
`POST https://api.scnet.cn/api/llm/v1/ocr/recognize`

## 请求头
- `Content-Type: multipart/form-data`
Confidence
89% confidence
Finding
https://api.scnet.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
)
        sys.exit(error_msg)

    config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1')
    return config

def recognize_with_retry(ocr_type, file_path, config, retry_count=0):
Confidence
96% confidence
Finding
https://api.scnet.cn/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.