ClawHub
Back to skill

Security audit

General Print Invoice Ocr

Security checks for vulnerabilities and agentic risk

Overview

This invoice OCR skill is mostly purpose-aligned, but it can upload sensitive invoice files and the API token to an unvalidated, configurable API endpoint.

Review this before installing if you will process real invoices. Use only the official Scnet endpoint unless you fully control and trust an alternate endpoint, keep `SCNET_API_KEY` out of chats, and avoid uploading documents containing sensitive personal, banking, tax, or business data without approval from the data owner.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/main.py:50
Finding

Unrestricted API endpoint override can exfiltrate credentials and sensitive invoice data

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:64
Finding

Unpinned third-party dependency installation reduces supply-chain integrity

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/main.py (reported line 20)May include surrounding context.

python
# 获取技能根目录（脚本所在目录的上一级）
SKILL_ROOT = Path(__file__).parent.parent.absolute()
ENV_FILE = SKILL_ROOT / "config" / ".env"

# --- 新增：重试配置 ---
MAX_RETRIES = 3            # 最大重试次数

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
# --------------------

def load_config():
    """从环境变量或 .env 文件加载配置，环境变量优先"""
    config = {}

    # 1. 如果 config/.env 存在，先加载其中的变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
# --------------------

def load_config():
    """从环境变量或 .env 文件加载配置，环境变量优先"""
    config = {}

    # 1. 如果 config/.env 存在，先加载其中的变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/main.py (reported line 29)May include surrounding context.

python
# --------------------

def load_config():
    """从环境变量或 .env 文件加载配置，环境变量优先"""
    config = {}

    # 1. 如果 config/.env 存在，先加载其中的变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/main.py (reported line 32)May include surrounding context.

python
# --------------------

def load_config():
    """从环境变量或 .env 文件加载配置，环境变量优先"""
    config = {}

    # 1. 如果 config/.env 存在，先加载其中的变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/main.py (reported line 45)May include surrounding context.

python
# --------------------

def load_config():
    """从环境变量或 .env 文件加载配置，环境变量优先"""
    config = {}

    # 1. 如果 config/.env 存在，先加载其中的变量

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

md
* [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/)
* [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/)
* [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html)
* [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/)
* [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documentation indicates capabilities that involve reading local files, accessing environment variables, making network requests, and invoking Python from the shell, but it does not declare any explicit tool scope or permission boundaries. This weakens least-privilege controls and makes it easier for an agent runtime to grant broader access than necessary, especially because the skill accepts an arbitrary local file path and sends file contents to an external OCR API.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

SCNET_API_KEY=your_scnet_api_key_here

API 基础地址（一般无需修改）

SCNET_API_BASE=https://api.scnet.cn/api/llm/v1

text
2. 添加：`SCNET_API_KEY=你的密钥`
3. 设置文件权限为 600（仅所有者可读写）

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

SCNET_API_KEY=your_scnet_api_key_here

API 基础地址（一般无需修改）

SCNET_API_BASE=https://api.scnet.cn/api/llm/v1

text
2. 添加：`SCNET_API_KEY=你的密钥`
3. 设置文件权限为 600（仅所有者可读写）

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The file documents use of an external endpoint (api.scnet.cn) for OCR, which means uploaded documents leave the local trust boundary and are processed by a third party. In the context of invoice OCR, this is security-relevant because the transmitted files and extracted fields can include sensitive financial, business, and personal information; without explicit trust, consent, and handling guarantees, this creates a real confidentiality risk.

Content

Scanner excerpt · references/api-docs.md (reported line 4)May include surrounding context.

md
# Sugon-Scnet OCR API 文档摘要

## 接口地址
`POST https://api.scnet.cn/api/llm/v1/ocr/recognize`

## 请求头
- `Content-Type: multipart/form-data`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly instructs clients to upload invoice images, PDFs, or archives to a third-party OCR endpoint but does not warn that sensitive financial and personal data will be transmitted off-platform. Because invoices commonly contain PII, tax IDs, bank account details, and transaction records, omission of a privacy/data-handling notice can lead to unintentional external disclosure by users or integrators.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file’s docstring and all user-facing messages are hard-coded in Chinese, indicating the skill operates in a single language without any user opt-in or alternative locale handling. This matches the policy category for language/locale constraints that are imposed rather than offered as a choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill sends user-supplied files and an API token to an external OCR service at api.scnet.cn. This is a real security-relevant data egress point because invoice images may contain sensitive financial or personal data, and the endpoint can also be overridden via SCNET_API_BASE, increasing SSRF/data exfiltration risk in untrusted environments.

Content

Scanner excerpt · scripts/main.py (reported line 55)May include surrounding context.

python
config['SCNET_API_BASE'] = env_api_base

    # 3. 设置默认值
    config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1')

    # 4. 检查必要配置
    api_key = config.get('SCNET_API_KEY', '')

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/main.py (reported line 71)May include surrounding context.

python
"2. 配置文件：\n"
            f"   mkdir -p {SKILL_ROOT}/config\n"
            f"   echo 'SCNET_API_KEY=你的真实密钥' > {ENV_FILE}\n"
            f"   chmod 600 {ENV_FILE}\n"
        )
        sys.exit(error_msg)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file presents user-facing natural language primarily in Chinese, including the title and release notes, without indicating that the skill is China-specific or offering any language/locale choice. Under the policy, a language constraint can be a violation when it is imposed without opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file includes git commands that reconfigure a remote and push a branch to origin, which can affect repository state. The README provides no warning or disclosure that these commands will modify a remote repository, so a user may execute them without realizing the impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description is written only in Chinese ('支持通用机打发票识别。'), which indicates a language-specific presentation without offering any user choice or documenting a justified locale constraint. Under the policy rules, language restrictions should be optional or clearly justified rather than implicit.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.