Security audit

packing_list_ocr

Security checks for vulnerabilities and agentic risk

Overview

This OCR skill mostly does what it claims, but it can upload any readable local file and the API token to a configurable external endpoint.

Review this skill before installing in sensitive environments. Only run it on files you intentionally want to send to Scnet, keep config/.env private, do not let untrusted chat content choose file paths, and avoid changing SCNET_API_BASE unless you fully trust the destination. Prefer adding file type, size, path, and endpoint allowlist checks before production use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/main.py:92
Finding: Unrestricted Local File Upload to a Remote OCR Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:78
Finding: Configurable API Base Can Exfiltrate the Bearer Token and Uploaded Documents
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:66
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/main.py (reported line 20)May include surrounding context.
python
# 获取技能根目录（脚本所在目录的上一级） SKILL_ROOT = Path(__file__).parent.parent.absolute() ENV_FILE = SKILL_ROOT / "config" / ".env" # --- 新增：重试配置 --- MAX_RETRIES = 3 # 最大重试次数

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
# -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
# -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/main.py (reported line 29)May include surrounding context.
python
# -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 38)May include surrounding context.
md
* [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/) * [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/) * [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html) * [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/) * [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation indicates capabilities that can read local files, invoke shell commands, and send data over the network, but it does not declare any explicit tool scope or permissions boundary. That omission increases the risk of overbroad execution in an agent environment, especially because the skill accepts an arbitrary local file path and uploads document contents to an external OCR API.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description, headings, parameter descriptions, warnings, and example user utterances are all written exclusively in Chinese, which effectively constrains the skill's interaction language. The file does not state that the skill is region-specific or provide any opt-in or alternative language option, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The skill is designed to transmit user-supplied local document images to an external third-party service endpoint for OCR. This is security-relevant because packing lists can contain sensitive commercial, personal, or shipment data, and the current documentation does not clearly require consent, data minimization, destination allowlisting, or retention/privacy disclosures.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
SCNET_API_KEY=your_scnet_api_key_here

API 基础地址（一般无需修改）

SCNET_API_BASE=https://api.scnet.cn/api/llm/v1

text
2. 添加：`SCNET_API_KEY=你的密钥` 3. 设置文件权限为 600（仅所有者可读写）

External Transmission

Medium

Category: Data Exfiltration
Confidence: 82% confidence
Finding: The configuration section reinforces that the skill depends on an external API base URL, which means document contents and metadata may leave the local environment. If the base URL is user-modifiable without validation, it also creates a risk of redirecting uploads to an attacker-controlled endpoint or an untrusted service.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
| 变量名 | 默认值 | 说明 | |--------|--------|------| | SCNET_API_KEY | 必需 | Scnet API 密钥 | | SCNET_API_BASE | https://api.scnet.cn/api/llm/v1 | API 基础地址（一般无需修改） | ### 输出

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This skill is explicitly designed to call an external OCR service at api.scnet.cn, which means document images/PDFs and associated metadata leave the trust boundary. While external access is expected for OCR functionality, it still represents a true data exfiltration surface if users are not informed and if sensitive trade documents are processed without appropriate controls.
Content: Scanner excerpt · references/api-docs.md (reported line 4)May include surrounding context.
md
# Sugon-Scnet OCR API 文档摘要 ## 接口地址 `POST https://api.scnet.cn/api/llm/v1/ocr/recognize` ## 请求头 - `Content-Type: multipart/form-data`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation shows that user-supplied files and an API bearer token are sent to a third-party OCR endpoint, but it does not warn about the resulting disclosure of document contents to an external service. In the context of packing lists, invoices, consignee/exporter identities, addresses, and shipment identifiers may contain sensitive commercial or personal data, so silent external transmission creates a real privacy and compliance risk.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/main.py (reported line 45)May include surrounding context.
python
" b) 配置文件：\n" f" mkdir -p {SKILL_ROOT}/config\n" f" echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n" f" chmod 600 {ENV_FILE}\n" "\n配置完成后重新运行。" ) sys.exit(error_msg)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/main.py (reported line 152)May include surrounding context.
python
" b) 配置文件：\n" f" mkdir -p {SKILL_ROOT}/config\n" f" echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n" f" chmod 600 {ENV_FILE}\n" "\n配置完成后重新运行。" ) sys.exit(error_msg)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The skill uploads user-supplied document files to an external OCR service at api.scnet.cn. This is a real data-exfiltration boundary because packing lists commonly contain sensitive commercial data such as consignor/consignee identities, shipment numbers, weights, and volumes. In the context of an OCR skill, external transmission is functionally expected, but it still creates confidentiality and compliance risk if users are not explicitly informed or if the endpoint can be overridden.
Content: Scanner excerpt · scripts/main.py (reported line 78)May include surrounding context.
python
) sys.exit(error_msg) config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1') return config def recognize_with_retry(ocr_type, file_path, config, retry_count=0):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description field is natural-language user-facing metadata, and it forces a specific language/locale experience with no opt-in or justification. Under the policy, language restrictions are acceptable only when the skill offers a choice or clearly documents that the locale constraint is intentional and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains user-facing natural language exclusively in Chinese ('变更日志', '新增装箱单识别功能') with no indication that the skill is region-specific or that language selection is optional. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Autonomous Decision Making

Undeclared Tool Scope

Natural-Language Policy Violations

External Transmission

API 基础地址（一般无需修改）

External Transmission

External Transmission

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

External Transmission

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis