Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward OCR helper with minor documentation gaps around privacy and language defaults, not evidence of unsafe behavior.
Install only if you are comfortable processing the selected images locally with Tesseract/pytesseract. Treat extracted text and saved JSON results as potentially sensitive, especially for receipts, forms, screenshots, and scanned documents; specify the OCR language when needed rather than relying on the English examples.
The skill notes that non-English text should be specified, but the examples and JSON schema default to English-centric behavior, including language_detected: "en" and lang='eng'. This can amount to a language policy violation because the skill assumes a specific language unless the user overrides it, rather than offering a neutral choice or explicit opt-in.
The sample implementation always returns "language_detected": "en" on success, regardless of the actual content or user preference. This embeds an English default in user-facing behavior and does not provide a language choice or opt-in.
This markdown skill describes OCR over receipts, forms, screenshots, and scanned documents, which commonly contain sensitive personal or financial information. The file explains usage and output format but does not include any explicit warning about privacy, handling sensitive content, or reviewing extracted text before storage or sharing.
The manifest describes a skill for extracting text content from images, which implies reading images and returning OCR results. The documented batch-processing code also saves aggregated results to a file, adding a persistence/output-writing behavior that is not mentioned in the skill description.
