文档扫描增强

• Outcome: Review
• Latest audit: Aug 25, 2026 · 2:55 PM UTC
• Version: 1.0.1

Overview

This document-scanning skill is mostly disclosed, but it needs Review because it mixes broad execution authority with unrelated activation guidance and normalizes watermark and exam-answer removal.

Review before installing. Only use this skill for images you are allowed to process and send to the external scan service, avoid sensitive documents unless that transfer is acceptable, and do not use the watermark or exam-answer removal workflows for third-party, copyrighted, academic, legal, or authenticity-marked materials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger guidance is overly broad and unrelated to the tool's actual image-processing purpose, encouraging invocation during code generation, debugging, deployment, and other unrelated workflows. In an agent environment with exec/read/write permissions, such scope confusion increases the chance the skill is selected in unsafe contexts and that untrusted user input is funneled into command execution paths or external processing unintentionally.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The catch-all 'scan-document' fallback is defined too vaguely, allowing the skill to handle loosely specified requests without a precise, user-confirmed intent. In agentic systems, vague fallback rules can cause overreach, misprocessing of sensitive images, or execution of external API calls when the user did not clearly authorize that specific operation.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Forcing Chinese interaction without user opt-in can mislead users about what operation will be performed, especially where security-sensitive image transformations or data transfers are involved. While not a classic exploit, it degrades informed consent and can obscure safety-critical details, errors, or data-handling notices for non-Chinese-speaking users.

Ssd 4

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly frames handwritten-answer removal as restoring a completed exam paper to a blank one, which is a deceptive manipulation use case rather than a neutral cleanup task. This materially increases abuse potential for academic fraud, record tampering, or falsification of documents, especially because the tool is presented as a straightforward supported workflow.

Ssd 4

Medium

• Confidence: 97% confidence
• Finding: Presenting watermark removal as a normal supported operation encourages deletion of provenance and ownership markers from images. In context, this is more dangerous because the skill is an automated enhancement tool with exec capability and external processing, making it easy to operationalize copyright evasion, fraud, or evidence tampering at scale.

Static analysis

No suspicious patterns detected.