Security audit

china-doc-ocr

Security checks across malware telemetry and agentic risk

Overview

This is a coherent cloud OCR skill, but users should know selected documents and prompts are sent to SiliconFlow and outputs may persist in the workspace.

Install only if you are comfortable sending selected documents, URLs, and prompts to SiliconFlow for processing. Avoid highly confidential, regulated, or third-party documents unless your policy allows that provider, use a limited API key, watch quota/billing, and delete saved OCR outputs or temporary workspace files when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Low

Confidence: 76% confidence
Finding: The skill allows arbitrary http/https URLs as OCR input, which broadens it from local document processing to remote fetching of untrusted content. This can enable SSRF-like misuse, unexpected access to internal resources depending on runtime networking, or processing of attacker-controlled payloads without validation.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill metadata and module docstring present this as a focused OCR capability, but the implementation actually forwards document contents to a remote chat-completions API and allows selection of general multimodal models. This mismatch is security-relevant because users may provide sensitive documents believing they are using a narrower OCR pipeline, while the code enables broader third-party processing than advertised.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The --prompt parameter is unconstrained and is sent directly with the document to a vision-language model, enabling arbitrary analysis, summarization, extraction, or inference beyond OCR. In a document-processing skill, this materially expands capability from text recognition to unrestricted third-party document interpretation, which increases privacy, compliance, and misuse risk for sensitive files.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill sends user-provided images, PDFs, invoices, and identity documents to external OCR services, but the documentation does not prominently warn users up front that sensitive files leave the local environment. This is especially risky because the stated use cases include highly sensitive personal and financial documents, creating material privacy, compliance, and data-handling exposure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The prompt templates explicitly encourage extraction of highly sensitive documents such as invoices, ID cards, business licenses, bank statements, and contracts, but provide no privacy, minimization, masking, retention, or consent guidance. In an OCR skill whose purpose is structured extraction of document contents, this omission materially increases the risk of unnecessary collection, overexposure, and downstream leakage of personal, financial, and business-sensitive data.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: When a local image or PDF is provided, the file is base64-encoded and transmitted to SiliconFlow without any user-facing disclosure, confirmation, redaction option, or sensitivity check. This is dangerous because documents handled by OCR often contain PII, financial data, IDs, invoices, or contracts, and the skill context makes silent third-party exfiltration especially risky.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.