ClawHub
Back to skill

Security audit

personal_card_ocr

Security checks across malware telemetry and agentic risk

Overview

This OCR skill is high-sensitivity because it uploads user-selected identity or financial document images to Scnet, but that behavior is clearly disclosed, purpose-aligned, and user-directed.

Install only if you are comfortable sending the selected document image and extracted OCR data to Scnet for processing. Use it only on documents you are authorized to upload, minimize what you send, keep SCNET_API_KEY out of chat, protect config/.env permissions, and leave SCNET_API_BASE at the default unless you deliberately trust the replacement endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill documentation describes capabilities to read user-supplied local files, invoke Python via shell, and transmit image contents to an external OCR API, but no explicit permissions model is declared. This creates a transparency and governance gap: users or orchestrators may not have a machine-readable warning that sensitive local files and identity documents will be accessed and sent off-device.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation describes uploading highly sensitive identity documents to a third-party OCR endpoint but does not prominently warn about the privacy, consent, retention, and cross-boundary handling risks of transmitting this data off-device. In the context of a skill that processes ID cards, passports, bank cards, and similar documents, this omission materially increases the chance that users or implementers will send regulated personal data without informed consent or appropriate safeguards.

External Transmission

Medium
Category
Data Exfiltration
Content
| 变量名 | 默认值 | 说明 |
|--------|--------|------|
| SCNET_API_KEY | 必需 | Scnet API 密钥 |
| SCNET_API_BASE | https://api.scnet.cn/api/llm/v1 | API 基础地址（一般无需修改） |

### 输出
Confidence
95% confidence
Finding
The skill explicitly sends uploaded images to a third-party endpoint at api.scnet.cn for OCR processing. Because the supported inputs include highly sensitive identity and financial documents, this external transmission materially increases privacy and compliance risk if users are not fully informed, if transport/configuration is altered, or if the third party mishandles data.

External Transmission

Medium
Category
Data Exfiltration
Content
# Sugon-Scnet OCR API 文档摘要

## 接口地址
`POST https://api.scnet.cn/api/llm/v1/ocr/recognize`

## 请求头
- `Content-Type: multipart/form-data`
Confidence
87% confidence
Finding
The file documents transmission of user-supplied OCR inputs to an external service endpoint, which is a real data-exfiltration surface because the skill handles extremely sensitive documents such as IDs, passports, household registry records, and bank cards. Although external transmission is expected for a cloud OCR integration, the skill context makes it more dangerous because the uploaded content is high-value personal data and the documentation does not pair the endpoint with strong security/privacy constraints.

External Transmission

Medium
Category
Data Exfiltration
Content
)
        sys.exit(error_msg)

    config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1')
    return config

def recognize_with_retry(ocr_type, file_path, config, retry_count=0):
Confidence
97% confidence
Finding
The skill is explicitly designed to upload locally supplied images containing highly sensitive personal documents to a third-party OCR service. Even though the transfer uses HTTPS and the skill warns the user, this still creates a real privacy and data exfiltration risk because IDs, bank cards, passports, and similar documents leave the local environment and are processed by an external provider.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.