ClawHub
Back to skill

Security audit

Upstage Ocr

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a straightforward Upstage OCR helper, but users should understand that documents are uploaded to Upstage for processing.

Install only if you are comfortable sending chosen files to Upstage's external OCR service. Avoid using it for highly sensitive IDs, legal, medical, financial, or confidential business documents unless you have reviewed and accepted Upstage's data handling terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill repeatedly instructs sending user-provided documents to a third-party OCR service but never includes an explicit user-facing warning that document contents leave the local environment. This is dangerous because users may submit sensitive scans (IDs, invoices, medical or legal records) without informed consent about external transmission and retention behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
import os
import requests

response = requests.post(
    "https://api.upstage.ai/v1/document-digitization",
    headers={"Authorization": f"Bearer {os.environ['UPSTAGE_API_KEY']}"},
    files={"document": open("scan.pdf", "rb")},
Confidence
90% confidence
Finding
This code performs an outbound POST that uploads the document file to Upstage's external OCR API. In the context of OCR on potentially sensitive files, external transmission is security-relevant because it exposes document contents to a third party and may violate user expectations if not clearly disclosed.

External Transmission

Medium
Category
Data Exfiltration
Content
def ocr_document(file_path):
    with open(file_path, "rb") as f:
        response = requests.post(
            "https://api.upstage.ai/v1/document-digitization",
            headers={"Authorization": f"Bearer {os.environ['UPSTAGE_API_KEY']}"},
            files={"document": f},
Confidence
90% confidence
Finding
This example function uploads a local file to the external Upstage OCR endpoint. While expected for the skill's purpose, it remains a real privacy/security issue because arbitrary user documents may be exfiltrated to a third-party service without a strong in-skill warning or consent gate.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests

response = requests.post(
    "https://api.upstage.ai/v1/document-digitization",
    headers={"Authorization": f"Bearer {os.environ['UPSTAGE_API_KEY']}"},
    files={"document": open("scan.pdf", "rb")},
    data={"model": "ocr"}
Confidence
87% confidence
Finding
The hardcoded Upstage API URL indicates that document contents are sent to an external network destination. The risk is contextual rather than inherently malicious: the skill is designed for OCR, but the lack of prominent disclosure makes the transmission meaningful from a data-protection standpoint.

External Transmission

Medium
Category
Data Exfiltration
Content
### Sync — Basic OCR

```bash
curl -X POST "https://api.upstage.ai/v1/document-digitization" \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "document=@/path/to/image.jpg" \
  -F "model=ocr"
Confidence
87% confidence
Finding
This curl example explicitly uploads a file to Upstage's external OCR service. Because users may copy-paste examples without realizing their documents are leaving their environment, this creates a genuine disclosure and data-transfer risk.

External Transmission

Medium
Category
Data Exfiltration
Content
def ocr_document(file_path):
    with open(file_path, "rb") as f:
        response = requests.post(
            "https://api.upstage.ai/v1/document-digitization",
            headers={"Authorization": f"Bearer {os.environ['UPSTAGE_API_KEY']}"},
            files={"document": f},
            data={"model": "ocr"}
Confidence
87% confidence
Finding
This code references the external Upstage OCR endpoint in a reusable helper, normalizing third-party upload of local documents. In a document-processing skill, that behavior is expected, but it still represents external transmission of potentially confidential content and should be treated as a real security concern.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 1. Submit
curl -X POST "https://api.upstage.ai/v1/document-digitization/async" \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "document=@large.pdf" \
  -F "model=ocr"
Confidence
87% confidence
Finding
The async example uploads a potentially large PDF to an external OCR service. Large batch uploads increase exposure because many pages of potentially sensitive content may be transmitted and stored remotely for later retrieval.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests

api_key = os.environ["UPSTAGE_API_KEY"]
base = "https://api.upstage.ai/v1/document-digitization"

with open("large.pdf", "rb") as f:
    r = requests.post(
Confidence
85% confidence
Finding
This example defines the external API base and uses it for async submission and result retrieval, enabling full remote processing of local documents. The danger is amplified by batch downloads and remote result storage, which broaden the privacy impact if users are not clearly warned.

Static analysis

No suspicious patterns detected.