文本识别OCR

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 1.0.0

Overview

This OCR skill is a plausible remote API wrapper, but it asks for and stores an API key in plaintext and can send images and the key to a configurable remote endpoint without clear safeguards.

Review before installing. This skill sends your image URL or full base64 image to XiaoBenYang's remote API and stores your API key in a local .env file. Use it only in a trusted workspace, avoid sensitive documents unless you accept that remote processing, and rotate the API key if the project directory or .env may have been shared.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/call_api.py:56

Finding

Configurable API Endpoint Enables API Key and OCR Data Disclosure

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/config.py:45

Finding

API Key Persisted in Plaintext Without Enforced Restrictive File Permissions

Content

View full analysis

bool: """Save the API key to the .env file.""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return False ``` ### Technical Analysis The API key is written directly into `.env` as plaintext. The call to `Path.write_text()` does not explicitly create the file with owner-only permissions, and the function does not inspect or correct permissions on an existing `.env` file. The resulting access permissions depend on the host operating system, current process umask, and pre-existing file mode. In a shared or permissively configured environment, another local account or process may be able to read the credential. Storing `.env` inside the project directory also creates a risk that the file will be copied, archived, uploaded, or committed to source control accidentally. The function additionally overwrites the file non-atomically. Although this is primarily a reliability concern, secure credential persistence should avoid partial files and should explicitly preserve restrictive access controls. ### Attack Path 1. The user provides an API key to the Skill. 2. The Skill ...[truncated 1138 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as OCR, but it also reads, writes, and persists API keys through environment and .env management. That behavior materially expands the security scope from image processing to secret handling and local configuration mutation, which is not transparently disclosed to users.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as OCR, but it also reads, writes, and persists API keys through environment and .env management. That behavior materially expands the security scope from image processing to secret handling and local configuration mutation, which is not transparently disclosed to users.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.

python

model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.

python

model_config = SettingsConfigDict(
        env_prefix="XBY_GAOKAO_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.

python

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.

python

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code writes the API key into a local .env file and also exports it into the process environment, creating multiple persistence locations for a sensitive secret. This increases the likelihood of credential leakage through file disclosure, backups, logs, misconfigured packaging, or reuse by unrelated components running in the same process.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This function is explicitly designed to persist an API key into a .env file, which creates a durable plaintext secret on disk. In the context of an OCR skill, that capability is unnecessary and dangerous because it broadens the skill from document processing into local credential storage, making accidental disclosure or later abuse much more likely.

Content

Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.

python

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill exposes capabilities implying environment access, file read/write, and network use, but does not declare an explicit tool scope or permissions boundary. That increases the chance of over-privileged execution and makes it harder for reviewers or the runtime to constrain what the skill may access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language content throughout the skill is entirely in Chinese and presents the skill as operating in that locale, but there is no explicit opt-in, language selection, or justification that this is a region-specific tool. Under SQP-3, forcing a specific language without user choice can be a policy violation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the model to ask the user for an API key and then persist it via configuration writes. Collecting secrets in-band through the chat flow and storing them locally increases the risk of accidental disclosure, improper retention, logging exposure, and reuse outside the user's expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation mixes OCR with unrelated school-search/gaokao references, indicating copied or inconsistent workflow instructions. Such inconsistencies can cause the agent to call unintended functions or mask broader functionality than users expect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow explicitly instructs use of an unrelated search_schools function despite the declared OCR toolset. Contradictory invocation guidance increases the risk of unintended tool use and suggests the skill specification may not reliably describe what the agent should execute.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill asks users to provide image URLs or base64 image data to a remote OCR service without warning that image contents may contain sensitive information and will be transmitted externally. In OCR contexts, uploaded images often contain personal, financial, or confidential text, so lack of notice increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction to directly display raw API/OCR output can expose sensitive extracted text from uploaded images without review or minimization. Since OCR commonly processes IDs, invoices, screenshots, and documents, raw output presentation may leak more personal or confidential data than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code sends request parameters to an external API and includes an API key in headers, which is a safety-relevant network operation. While the module has internal logging for success/error paths, there is no user-facing warning, confirmation, or explanatory comment/docstring disclosing that user-supplied data and credentials are transmitted off-system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The OCR skill claims a narrow text-recognition purpose, but this module adds persistent API-key management functionality unrelated to simple OCR input processing. Expanding a skill's capabilities to read, store, and expose external service credentials increases attack surface and creates an unnecessary secret-handling pathway that could be abused by other code in the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function sends a user-supplied image URL to an external OCR API, but this file provides no disclosure, consent mechanism, or indication of where the image data will be processed. Because images may contain sensitive personal, financial, or business information, silent transfer to a third party creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This function transmits raw base64-encoded image contents directly to an external API, which can expose the full contents of sensitive documents or screenshots without any warning in this file. Base64 input often represents locally sourced files rather than public URLs, so the privacy impact is heightened because users may reasonably expect the data to remain local unless clearly informed otherwise.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency specification uses a lower bound (requests>=2.31.0) rather than an exact pin or constrained lockfile, which makes builds non-reproducible and can cause installation of later releases with undiscovered or newly introduced vulnerabilities. In a security-sensitive skill that may process external inputs and make network requests, supply-chain uncertainty increases operational risk even though the manifest itself is not directly exploitable.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

The manifest does not pin requests, and the package has multiple known advisories across versions, so security posture cannot be verified from this file. In an OCR skill, requests is likely used for remote API access or downloads, making dependency ambiguity more relevant because network-facing code often handles attacker-controlled destinations or content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

pydantic is declared with an open-ended minimum version, so deployments may resolve to different versions over time. That weakens reproducibility and makes it impossible to determine from this file alone whether the installed version includes fixes for known issues such as denial-of-service bugs.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

pydantic has known advisories in some versions, but the unpinned requirement prevents verification that deployed instances are patched. Since OCR skills often parse structured settings and user-provided metadata, leaving the version unresolved can expose the service to parser-level denial-of-service or validation flaws.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

pydantic-settings is also unpinned, so future installs may pull different releases with different security properties. For configuration-loading libraries, this matters because parsing and secrets-handling behavior can change and potentially expose the application to known package-level flaws.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

Static analysis

No suspicious patterns detected.