OCR - Local (No API Key)

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:37 AM UTC
• Version: 1.0.0

Overview

This is a coherent local OCR skill, but users should notice that setup and first use can download third-party Tesseract assets.

Before installing, consider whether your environment permits npm installs and first-run language-data downloads. For stricter or offline use, pin tesseract.js to a reviewed exact version, add a lockfile, prefetch or vendor language data, and avoid running installation or OCR as a privileged user.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package.json:16

Finding

Unpinned and Unlocked Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: package.json:16-18; related installation guidance at README.md:16-21 and PUBLISH.md:27-28
Vulnerability Type: Supply-chain exposure caused by non-reproducible dependency resolution
Risk Level: Medium

Vulnerable Code and Configuration

package.json:16-18:

json

"dependencies": {
  "tesseract.js": "^7.0.0"
},

README.md:16-21:

bash

# Manual installation
git clone https://github.com/openclaw/skill-ocr.git ~/.openclaw/workspace/skills/ocr
cd ~/.openclaw/workspace/skills/ocr
npm install

PUBLISH.md:27-28 explicitly states that the lockfile was removed:

text

- ❌ package-lock.json - Let users use the latest version

Technical Analysis

The dependency uses the caret version range ^7.0.0, which permits npm to install later compatible releases rather than the exact version reviewed with this skill. The project also deliberately omits package-lock.json and directs users to run npm install.

Consequently, installation is not reproducible: the resolved direct and transitive dependency graph may change over time without any modification to the audited project files. This creates a supply-chain trust gap between the reviewed artifact and the code ultimately installed on a user's system.

No evidence shows that the current tesseract.js package is malicious. The vulnerability is the unsafe dependency-management practice, which would allow a compromised, malicious, or unexpectedly changed release satisfying the declared range to enter installations without project-level review.

Attack Path

1. An attacker compromises an npm publisher account, an allowed future tesseract.js release, or one of its transitive dependencies.
2. The attacker publishes a release that satisfies ^7.0.0, or causes npm resolution to include a compromised transitive package.
3. A user follows the documented instructions and runs `npm instal ...[truncated 1278 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the version range with an exact reviewed version:

   json

   "dependencies": {
     "tesseract.js": "7.0.0"
   }
   

2. Generate and commit package-lock.json so direct and transitive dependency versions and integrity hashes are recorded.
3. Change installation and deployment instructions from npm install to npm ci, which enforces the committed lockfile.
4. Do not remove the lockfile to obtain newer packages automatically. Update dependencies through an explicit review process and regenerate the lockfile only after testing.
5. Review dependency release notes, package ownership changes, lifecycle scripts, and transitive dependency changes before accepting updates.
6. Run automated dependency and provenance checks in CI, such as npm audit, lockfile-diff review, and registry integrity verification.
7. Where operationally possible, install dependencies with lifecycle scripts disabled using npm ci --ignore-scripts, then enable only installation behavior demonstrated to be necessary.
8. Avoid running installation or OCR commands as root or another privileged account, and isolate processing of untrusted images in a restricted environment.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill markets itself as '100% local' and 'no API key required', but the note that it downloads language data on first run means it performs network access and introduces a supply-chain and privacy boundary not disclosed by the headline claim. Users may run it in restricted or sensitive environments assuming zero network activity, which can lead to policy violations, unexpected egress, or trust in unpinned remote assets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This publish document is entirely written in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is intentional for a region-specific audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README indicates in notes that first use downloads Tesseract.js language data, but it does not clearly frame this as a privacy/network behavior or warn users before installation/use. In a '100% local, no API key required' OCR skill, users may reasonably assume fully offline operation, so undisclosed runtime downloads can mislead security-conscious users and cause unexpected outbound network access.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a caret range (^7.0.0), which allows new minor and patch releases to be installed without explicit review. This weakens build reproducibility and can unintentionally introduce vulnerable or malicious upstream changes, especially in a supply-chain-sensitive package manifest.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"license": "MIT",
  "acceptLicenseTerms": true,
  "dependencies": {
    "tesseract.js": "^7.0.0"
  },
  "repository": {
    "type": "git",

Unverifiable Dependency: tesseract.js has 1 known advisory(ies) (GHSA-83rx-c8cr-6j8q (Insecure Default Configuration in tesseract.js)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The manifest references tesseract.js without pinning an exact version, while the package has a known advisory for insecure default configuration. Because the resolved installed version is not fixed, it is not possible to verify from this file alone whether deployments will pull a safe release, creating avoidable uncertainty around exposure to the advisory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.