Tesseract Receipt Tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:40 AM UTC
• Version: 1.0.0

Overview

This receipt OCR skill is mostly aligned with its stated purpose, but it asks agents to run unpinned package installs and a privileged system install without clear user control or warnings.

Review before installing. Only use this in an environment where you are comfortable with package installation, preferably after installing Tesseract separately through your normal admin process. Avoid letting an agent run the sudo apt command or unpinned pip install automatically, and expect the parser to produce limited JSON rather than the full receipt/invoice tracking described.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned and Unnecessary PyPI Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–16
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable code snippet:

markdown

2. **Setup tesseract**:
   ```
   exec pip install tesseract
   ```
   Tesseract: `exec sudo apt update && sudo apt install tesseract-ocr`

Technical Analysis

The setup instructions direct the agent to install the unpinned PyPI package tesseract without a lockfile, package hash, exact version, or source verification. Python package installation can execute package-controlled build or installation logic. Consequently, the effective code installed by this instruction can change after the Skill has been reviewed.

The project parser does not import or otherwise use this Python package. The separately installed operating-system package, tesseract-ocr, provides the OCR executable required by the documented workflow. The PyPI installation therefore creates avoidable supply-chain exposure.

This finding does not establish that the current tesseract package is malicious. The vulnerability is the unsafe reliance on a mutable, unverified, and unnecessary dependency.

Attack Path

1. A user activates the Skill for receipt processing.
2. The agent follows the documented setup workflow and executes pip install tesseract.
3. The package installer resolves the mutable package name through its configured package index.
4. If the package, one of its dependencies, the index, or the resolution configuration has been compromised, attacker-controlled build or installation code executes.
5. That code runs with the privileges of the account invoking pip and can access resources available to that account.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the invoking user's privileges. This may permit access to that user's files, environment variables, application credentials ...[truncated 386 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec pip install tesseract because the project code does not use that Python package.
2. Install only the official tesseract-ocr operating-system package from a trusted, configured distribution repository.
3. Avoid unattended privilege elevation. Ask the user to approve system package installation explicitly, or document Tesseract as a prerequisite.
4. If a Python binding later becomes necessary, select the correct reviewed package and pin its exact version and cryptographic hashes in a lockfile or requirements file.
5. Install Python dependencies in an isolated virtual environment under a non-privileged account.
6. Use an approved internal package mirror or otherwise verify package provenance and dependency integrity before installation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description promises a fairly full-featured OCR receipt/invoice tracker using tesseract for extracting multiple fields from images, including tax, mileage, and items, with JSON/CSV output. The supplied code does much less: it only parses already-available text input, not images, and uses a few regexes to extract total, a date, and vendor. It does not invoke tesseract or any OCR library, does not extract tax or item lines, and does not output CSV. There is also a likely bug in date formatting ('0/1/2'.format(...)) and the mileage block is effectively always enabled because 'receipt' in ['mileage', 'log'] is false as written for intent, showing mismatch with the described mileage logging functionality. This is a material underimplementation of the declared purpose, so the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The chained command sudo apt update && sudo apt install tesseract-ocr combines multiple privileged operations in one step, reducing opportunities for review and making it easier to normalize command chaining in agent workflows. In adversarial or error-prone contexts, chained privileged commands can amplify impact by automatically proceeding from network/package metadata refresh to installation without an explicit checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

text

   exec pip install tesseract

Tesseract: exec sudo apt update && sudo apt install tesseract-ocr

3. Extract Text:

   text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill invokes privileged and command-execution style operations (exec, package installation, OCR binaries) but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance an agent can read arbitrary local files or use broader capabilities than users expect, especially since the workflow starts by reading a user-supplied image path.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description lists triggers such as "log receipt", "invoice data", and "etc.", which are ambiguous and not clearly bounded. This makes it unclear when the skill should activate versus when a general conversation about receipts, invoices, or expenses should not invoke it.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow directs the agent to install software and run shell commands, including system package management, even though the stated purpose is simple OCR receipt parsing. Expanding from document processing into host modification materially increases attack surface and can be abused to alter the environment, fetch untrusted packages, or normalize unsafe command execution in routine tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill tells users/agents to run sudo package-install commands without clearly warning that this modifies the host system. Hidden or underexplained system modification is dangerous because it can lead to unauthorized changes, break environments, or condition users to approve privileged operations in low-risk-looking tasks like receipt extraction.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The presence of sudo introduces privileged execution into a skill that should only perform OCR and data extraction. If followed by an agent or user, this grants root-level system modification capability, greatly increasing the risk of host compromise, persistence, package tampering, or collateral damage from malformed commands.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

text

   exec pip install tesseract

Tesseract: exec sudo apt update && sudo apt install tesseract-ocr

3. Extract Text:

   text

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a broader OCR receipt/invoice tracker that extracts date, vendor, amount, tax, mileage, and items and outputs structured JSON/CSV for multiple expense contexts. In this file, the code only parses total, date, vendor, an effectively unreachable mileage field, hard-codes category to receipt, and prints JSON only, which materially underdelivers the claimed behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The comment suggests the following block performs receipt-specific handling, yet if 'receipt' in ['mileage', 'log'] is always false, so mileage extraction never occurs. This is an active contradiction between the code documentation and the real behavior, not merely an omitted detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.