Security audit
Security checks for vulnerabilities and agentic risk
This OCR skill appears legitimate, but it sends potentially sensitive documents to a third-party OCR API and tells agents to keep results in the workspace long-term.
Install only if you are comfortable sending documents to SiliconFlow for OCR. Avoid using it on unredacted IDs, bank statements, contracts, invoices, or regulated business records unless you have permission to upload them, and delete retained workspace outputs when finished.
The skill declares access to environment variables and relies on a networked OCR API, but it does not define an explicit tool/permission scope. That creates an authorization transparency gap: users and hosting systems may not clearly understand that the skill can access secrets and transmit document contents externally.
The skill behavior expands beyond transient OCR processing by stating that recognition results are saved to the workspace for long-term retention, while the manifest describes only recognition/conversion. For documents like IDs, invoices, contracts, and receipts, silent persistence increases the risk of unauthorized later access, secondary use, or accidental disclosure of sensitive extracted data.
The skill explicitly says OCR results are stored in the workspace long-term, but does not provide a clear upfront warning or consent flow despite handling highly sensitive personal and financial documents. This can expose extracted PII, business data, and identity documents to unnecessary retention and later compromise.
The guidance explicitly states '中文场景最佳' and routes key document classes such as invoices, receipts, and IDs to a Chinese-first model, which can bias the agent into responding or extracting in Chinese by default rather than following the user's language preference. In an OCR skill, this is risky because output language affects usability, downstream automation, and can cause incorrect or unwanted translations or formatting for non-Chinese users.
The prompt templates explicitly support extraction of highly sensitive personal and financial data such as ID card numbers, bank transactions, invoices, and business registration details, but they provide no user-facing privacy warning, minimization guidance, or handling constraints. In an OCR skill, this increases the likelihood that users will submit regulated or confidential documents without understanding the sensitivity of the data being processed or the need to redact, mask, or limit output.
The skill description and code behavior do not fully match: the implementation uploads documents to SiliconFlow's chat-completions endpoint and uses models beyond the ones implied by the manifest, including a generic DeepSeek V3 entry. This is dangerous because users may provide sensitive documents under inaccurate assumptions about what service and model will process them, undermining informed consent and trust boundaries.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
import urllib.error
SILICONFLOW_API_URL = "https://api.siliconflow.cn/v1/chat/completions"
MODELS = {
"paddleocr": "PaddlePaddle/PaddleOCR-VL-1.5",
When a local image or PDF is provided, the script base64-encodes the entire file and transmits it to a remote API without any explicit warning, consent gate, or data-classification check. In the context of OCR for invoices, IDs, receipts, and documents, this is especially risky because the files commonly contain highly sensitive personal, financial, or identity data.
The skill name, description, and examples are oriented to Chinese-language usage and China-specific OCR scenarios, but the file does not state that this is a region-specific skill or offer language/locale choice. Under the policy, locale constraints should either be explicitly justified as region-specific or provide user opt-in.
The manifest presents the skill as a document OCR and structured extraction tool, but does not mention any dependency on external credentials or third-party cloud inference. Accessing environment-stored credentials is a separate capability that is not justified by the stated purpose unless the manifest explicitly discloses remote-service usage.
No suspicious patterns detected.