GT Simon Deepseek Ocr

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:55 PM UTC
• Version: 1.0.1

Overview

This appears to be an OCR skill with no persistence or destructive behavior, but its included CLI can send local image paths to a configurable plaintext OCR service.

Install only if you are comfortable using a local or trusted DeepSeek OCR service. Keep the OCR host on loopback or another trusted endpoint, and avoid using it with sensitive filenames or directories unless the data-handling behavior is documented and acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: Scripts/index.js:39

Finding

Absolute Local File Path Disclosure to a Configurable Plaintext HTTP Endpoint

Content

View full analysis

Vulnerability Details

File Location: Scripts/index.js, lines 39-59
Vulnerability Type: Local path information disclosure over an unencrypted and configurable network connection
Risk Level: Medium

Vulnerable Code

javascript

const OCR_HOST = process.env.DEEPSEEK_OCR_HOST || "127.0.0.1";
const OCR_PORT = process.env.DEEPSEEK_OCR_PORT || 8001;

const payload = JSON.stringify({
  image: absolutePath
});

const options = {
  hostname: OCR_HOST,
  port: OCR_PORT,
  path: "/ocr",
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Content-Length": Buffer.byteLength(payload)
  },
  timeout: 120000
};

const req = http.request(options, (res) => {

Technical Analysis

The CLI resolves the user-supplied image path to an absolute filesystem path and transmits that path in a JSON request. The destination host and port can be changed through the DEEPSEEK_OCR_HOST and DEEPSEEK_OCR_PORT environment variables.

The request uses Node.js http.request, so no TLS encryption or endpoint authentication is provided. If the host is configured as a remote server, the absolute path may cross the local trust boundary in plaintext. Absolute paths can reveal usernames, home-directory layouts, mounted volumes, project names, customer identifiers, and sensitive filenames.

The implementation sends only the path and not the image contents. Consequently, a remote OCR service normally cannot access the image unless it shares the same filesystem. This limits direct exposure to path metadata but also makes the documented OCR operation unreliable outside a shared local environment.

Attack Path

1. An attacker or compromised execution environment gains influence over DEEPSEEK_OCR_HOST and, if needed, DEEPSEEK_OCR_PORT.
2. The endpoint is changed to an HTTP server controlled by the attacker.
3. A user or agent invokes the CLI with --image referencing a local image.

...[truncated 1046 chars]

Remediation

View remediation

Remediation Suggestions

1. Keep the OCR endpoint restricted to loopback unless remote operation is explicitly required.
2. Reject non-loopback destinations by default and use an explicit host allowlist for approved remote services.
3. Require HTTPS for every remote endpoint and validate its certificate. Do not allow silent fallback to plaintext HTTP.
4. Read and transmit validated image bytes rather than exposing an absolute local path. Enforce permitted image formats and strict file-size limits before upload.
5. If a shared-filesystem service is intentionally required, pass a normalized identifier or an approved path relative to a narrowly scoped image directory instead of an unrestricted absolute path.
6. Authenticate the OCR service and validate that responses originate from the intended endpoint.
7. Document the network transfer, destination configuration, and data-handling behavior so users can provide informed consent.
8. Treat environment variables as untrusted configuration in managed or multi-tenant execution environments and prevent unauthorized parties from changing the endpoint.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

No manifest is available, so there is no stated purpose that would justify this script's ability to read process environment variables and send data over HTTP to a service endpoint. The code not only processes a local image path but also depends on externally configurable network communication, which is a broader capability than simple local file handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description 'OCR skill' is too vague to communicate the skill's intended scope, permissible inputs, or operational boundaries. Ambiguous descriptions can cause over-broad invocation, misuse in unintended workflows, and make it harder for reviewers to assess whether the skill's behavior is appropriate for sensitive or regulated content.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: Scripts/index.js:37