ClawHub
Back to skill

Security audit

Medical Invoice Ocr

Security checks across malware telemetry and agentic risk

Overview

This skill coherently sends a user-selected medical invoice file to the disclosed SCNet OCR API using a configured API key.

Install only if you are comfortable sending medical invoice images or PDFs to SCNet's OCR service. Keep SCNET_API_KEY in an environment variable or chmod-600 config/.env file, verify SCNET_API_BASE before use, and do not paste the key into chat.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill declares no explicit permissions even though its documented behavior clearly requires environment-variable access, local file reads, outbound network access, and shell execution. This weakens least-privilege controls and can mislead operators about what the skill is capable of, increasing the chance of overbroad or unreviewed execution in sensitive environments.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.