ClawHub
Back to skill

Security audit

Mobile Pay Bill Ocr

Security checks across malware telemetry and agentic risk

Overview

This skill does a disclosed payment-bill OCR upload, but its code and reference docs leave the sensitive file-upload capability broader than its stated payment-only purpose.

Install only if you are comfortable sending payment screenshots to Scnet's remote OCR service. Use it only on files you explicitly choose, avoid documents with unrelated personal or identity data, review the provider's privacy/retention terms, and keep the API key in a protected local config file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill documentation indicates capabilities to read local files, invoke Python from the shell, and send data over the network, but it does not declare permissions explicitly. In an agent environment, this weakens transparency and policy enforcement, making it easier for sensitive local payment screenshots to be accessed and exfiltrated without clear user-facing capability boundaries.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The skill claims it is limited to mobile-payment-bill OCR and only triggers for specific user intents, but the documented behavior accepts arbitrary file paths and relies on external API handling rather than enforcing those restrictions itself. This mismatch can cause the agent to process unintended files or broader OCR tasks, increasing the risk of sensitive-data exfiltration and violating user expectations about when the skill should run.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The documented OCR endpoint is clearly general-purpose and the sample schema covers non-payment documents, which conflicts with the skill's declared narrow purpose of payment-bill extraction only. This mismatch is dangerous because it suggests the skill could be wired to a broader OCR capability than users would reasonably expect, enabling collection or processing of unrelated sensitive documents.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The example response explicitly includes ID-card fields, personal identity attributes, and document seal extraction, directly contradicting the skill's stated payment-bill-only function. That broadens the apparent data handling scope to highly sensitive PII and official-document analysis, increasing the risk of over-collection and misuse if the integration accepts arbitrary uploads.

Context-Inappropriate Capability

Low
Confidence
89% confidence
Finding
The notes advertise support for PDFs, multi-page archives, IDs, contracts, and stamps, which is unnecessary for a mobile payment screenshot OCR skill. While this is more of a scope-expansion and least-privilege problem than a direct exploit primitive, it increases the chance that users or integrators submit much broader and more sensitive document sets than intended.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation describes uploading files containing highly sensitive document content to a remote third-party OCR service, but does not disclose external transmission, retention, or privacy implications. In the context of a skill that may receive payment screenshots and potentially other sensitive documents, this creates a meaningful privacy and compliance risk because users may not realize their data leaves the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
| 变量名 | 默认值 | 说明 |
|--------|--------|------|
| SCNET_API_KEY | 必需 | Scnet API 密钥 |
| SCNET_API_BASE | https://api.scnet.cn/api/llm/v1 | API 基础地址（一般无需修改） |

### 输出
Confidence
88% confidence
Finding
https://api.scnet.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
# Sugon-Scnet OCR API 文档摘要

## 接口地址
`POST https://api.scnet.cn/api/llm/v1/ocr/recognize`

## 请求头
- `Content-Type: multipart/form-data`
Confidence
90% confidence
Finding
https://api.scnet.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
)
        sys.exit(error_msg)

    config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1')
    return config

def recognize_with_retry(ocr_type, file_path, config, retry_count=0):
Confidence
90% confidence
Finding
https://api.scnet.cn/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.