T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:77- Finding
Configurable Untrusted OCR Endpoint Can Receive Sensitive Files and API Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Image2text Ocr
Security checks for vulnerabilities and agentic risk
Overview
This OCR skill does what it claims, but it uploads local files and an API key to a configurable remote endpoint without enough scoping or user-facing disclosure.
Install only if you are comfortable sending OCR files to the SCNet remote service. Do not use it for highly sensitive documents unless you have verified the provider's privacy terms, keep config/.env private, and avoid changing SCNET_API_BASE unless you fully trust the endpoint.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:64- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 获取技能根目录（脚本所在目录的上一级） SKILL_ROOT = Path(__file__).parent.parent.absolute() ENV_FILE = SKILL_ROOT / "config" / ".env" # --- 新增：重试配置 --- MAX_RETRIES = 3 # 最大重试次数 RETRY_BACKOFF_FACTOR = 2 # 退避因子，每次重试等待时间翻倍
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md * [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/) * [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/) * [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html) * [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/) * [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documentation indicates capabilities to read local files, invoke Python from the shell, and send image contents to a remote OCR API, but it declares no explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and increases the chance the skill is invoked with broader host access than necessary, especially since it operates on arbitrary local file paths and network egress.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The top-level description says the skill should be used whenever the user needs OCR on an image, but it does not define clear trigger constraints, exclusions, or confirmation requirements before transmitting local files externally. Broad activation language can cause accidental invocation and unintended upload of sensitive documents to the third-party OCR service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
SCNET_API_KEY=your_scnet_api_key_here
API 基础地址（一般无需修改）
SCNET_API_BASE=https://api.scnet.cn/api/llm/v1
text 2. 添加：`SCNET_API_KEY=你的密钥` 3. 设置文件权限为 600（仅所有者可读写）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
SCNET_API_KEY=your_scnet_api_key_here
API 基础地址（一般无需修改）
SCNET_API_BASE=https://api.scnet.cn/api/llm/v1
text 2. 添加：`SCNET_API_KEY=你的密钥` 3. 设置文件权限为 600（仅所有者可读写）
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guidance says the AI will automatically trigger the skill based on description keywords, which is ambiguous and encourages invocation from natural-language cues rather than explicit consent. In this skill, automatic triggering is more dangerous because the action reads a local file and uploads its contents to a remote API, potentially exposing private documents unintentionally.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill depends on an external network endpoint for OCR processing, which means user files leave the local trust boundary and are sent to a remote service. In the context of OCR, this is security-relevant because uploaded documents may contain highly sensitive content, and the risk increases if users are not clearly informed or if the provider's handling guarantees are undocumented.
- Content
md # Sugon-Scnet OCR API 文档摘要 ## 接口地址 `POST https://api.scnet.cn/api/llm/v1/ocr/recognize` ## 请求头 - `Content-Type: multipart/form-data`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation instructs clients to upload user-provided images, PDFs, or archives to a third-party OCR endpoint but does not warn about external data transmission, retention, or privacy implications. In an OCR skill, inputs often contain sensitive personal, financial, legal, or confidential business information, so silent off-device transfer creates meaningful privacy and compliance risk.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python " b) 配置文件：\n" f" mkdir -p {SKILL_ROOT}/config\n" f" echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n" f" chmod 600 {ENV_FILE}\n" "\n配置完成后重新运行。" ) sys.exit(error_msg)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python " b) 配置文件：\n" f" mkdir -p {SKILL_ROOT}/config\n" f" echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n" f" chmod 600 {ENV_FILE}\n" "\n配置完成后重新运行。" ) sys.exit(error_msg)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The skill uploads user-supplied image files to an external OCR service at api.scnet.cn, which is a real data exfiltration boundary. OCR inputs commonly contain sensitive personal, financial, or business information, so transmitting them to a third-party service creates confidentiality and compliance risk even if the behavior is intended.
- Content
python ) sys.exit(error_msg) config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1') return config def recognize_with_retry(ocr_type, file_path, config, retry_count=0):
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description is written entirely in Chinese and specifies the skill behavior in that language, but it does not offer any user language choice or explain that the skill is intended only for a Chinese-speaking context. Under the policy criteria, forcing a specific language without opt-in or documented justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file is written primarily in Chinese, including the title and most change descriptions, with no indication that the skill is China-specific or that users can choose another language. This can conflict with organizational language/locale policies when a skill implicitly mandates a specific language for user-facing documentation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The entire markdown file is written in Chinese and does not indicate that the skill supports other languages or that Chinese is a required locale. Per the policy scope, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
L162 声称识别结果位于 data[0].result[0].elements，但同一文件中的示例 JSON 实际展示的是 data[0].result[0].text 结构，未出现 elements 字段。这属于文档对代码/实现意图的主动性误导：如果技能按该说明实现，可能提取错误字段，偏离“提取图片文字”的宣称行为。
- Content
Static analysis
No suspicious patterns detected.