ClawHub
Back to skill

Security audit

financial_bill_ocr

Security checks across malware telemetry and agentic risk

Overview

This skill uploads a user-specified financial document to Scnet for OCR, and that external upload is disclosed, but users should only use it for documents they are allowed to send to a third party.

Install only if your environment permits sending the selected financial documents to Scnet's OCR service. Do not use it on highly sensitive, regulated, or customer data without vendor approval, retention/data-residency review, and explicit user or administrator consent. Keep the API key out of chats, protect config/.env, and avoid changing SCNET_API_BASE unless the alternate endpoint is trusted.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill clearly performs local file access, network transmission, and shell-based invocation, yet the manifest does not declare any permissions or equivalent constraints. This creates a transparency and governance gap: an agent may invoke a skill that can read local files and exfiltrate document contents to a third party without an explicit permission boundary.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The manifest grants `shell:exec` even though the skill’s stated purpose is OCR/structured extraction of financial documents, which normally only requires file read and network access to an OCR backend. Unnecessary shell execution materially expands the attack surface: if any downstream component or prompt path can influence shell commands, the skill could execute arbitrary commands on the host and access sensitive financial files or credentials.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The activation guidance is broad enough that a generic request to 'recognize a financial document image' may auto-trigger the skill without strong confirmation that the user intends third-party upload. Because this skill handles sensitive financial records and transmits files externally, loose trigger criteria increase the chance of unintended data disclosure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document describes uploading financial and identity-bearing documents to a third-party OCR endpoint using multipart/form-data, but provides no explicit warning about privacy, retention, cross-border transfer, or handling of highly sensitive data. In the context of a financial bill OCR skill, this omission increases the risk that operators unknowingly transmit regulated personal and financial information to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
---
# Sugon-Scnet 金融单据识别 OCR 技能

本技能封装了金融单据识别的 OCR 服务，通过单一接口即可调用金融单据识别能力。识别过程中，**本地文件将被上传至第三方 OCR 服务 `https://api.scnet.cn/`** 进行处理，请确保图片中不包含高度敏感或受合规保护的信息，或确认当前环境允许外传。

## 功能特性
Confidence
95% confidence
Finding
The skill explicitly uploads local financial-document images to an external OCR endpoint. Even though the documentation warns about this behavior, the data involved can include bank, customs, invoice, and payment records, so external transmission materially increases confidentiality, privacy, and compliance risk if invoked on sensitive files.

External Transmission

Medium
Category
Data Exfiltration
Content
# Sugon-Scnet OCR API 文档摘要

## 接口地址
`POST https://api.scnet.cn/api/llm/v1/ocr/recognize`

## 请求头
- `Content-Type: multipart/form-data`
Confidence
88% confidence
Finding
The skill documentation instructs sending uploaded files to an external HTTPS endpoint, which constitutes external transmission of potentially sensitive financial documents and extracted data. In this skill context, the transmission is expected functionality, but it remains security-relevant because it expands the trust boundary to a third-party service and can expose confidential data if governance and disclosure are inadequate.

External Transmission

Medium
Category
Data Exfiltration
Content
)
        sys.exit(error_msg)

    config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1')
    return config

def recognize_with_retry(ocr_type, file_path, config, retry_count=0):
Confidence
95% confidence
Finding
The skill transmits user-supplied financial document files to an external third-party API endpoint at api.scnet.cn for OCR processing. Because these inputs may contain highly sensitive financial and personal data, sending them off-host creates a real confidentiality and compliance risk if users are unaware, if transport destinations are altered via configuration, or if the third party is not approved for such data handling.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.