T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:24- Finding
Unverified Remote Installer Is Downloaded and Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
BaiduOCR-LocalFallback
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with Baidu OCR use, but its install and credential handling create review-worthy security risk.
Review before installing. Prefer the included local installer over the one-click remote command, use a virtual environment with pinned dependencies, avoid the plaintext config file when possible, and do not process sensitive documents unless Baidu Cloud privacy and retention terms are acceptable for your use case.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Error
- Location
install.sh:43- Finding
Unpinned Python Dependencies Are Installed from Mutable Package Sources
- Content
View full analysis
/dev/null; then echo " requests already installed, skipping" else pip3 install requests fi if pip3 show easyocr &> /dev/null; then echo " easyocr already installed, skipping" else pip3 install easyocr fi if pip3 show Pillow &> /dev/null; then echo " Pillow already installed, skipping" else pip3 install Pillow fi echo "✓ Dependencies installed" } ``` The package metadata also uses open-ended minimum constraints: ```json "python": { "version": ">=3.8", "dependencies": [ "requests>=2.28.0", "easyocr>=1.7.0", "Pillow>=9.0.0" ] } ``` ### Technical Analysis The installer invokes `pip3 install` using package names without exact versions, hashes, a lock file, an enforced package index, or an isolated virtual environment. Although the package names shown are established projects rather than evident typosquats, the installation process trusts whichever package index and configuration are active on the user's system. The metadata's minimum-version constraints do not protect the installation because the shell installer does not use them. Even if they were used, constraints such as `>=1.7.0` permit future and unreviewed releases. Transitive dependencies are also unresolved and unpinned. Python packages or their dependencies may execute build backend or installation logic during installation, and subsequently execute code when imported. This creates a supply-chain execution path if a package source, future release, dependency, or configured mirror is compromised. ### Attack Path 1 ...[truncated 1136 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
install.sh:103- Finding
Baidu Secret Key Is Stored in Plaintext and Exposed in Process Arguments
- Content
View full analysis
"$CONFIG_FILE" << EOF { "api_key": "$API_KEY", "secret_key": "$SECRET_KEY" } EOF # Recommend restricting file permissions chmod 600 "$CONFIG_FILE" 2>/dev/null || true ``` The connection test extracts the plaintext values and places them in the command-line URL: ```bash if command -v curl &> /dev/null; then API_KEY=$(grep -o '"api_key"[[:space:]]*:[[:space:]]*"[^"]*"' "$CONFIG_FILE" | cut -d'"' -f4) SECRET_KEY=$(grep -o '"secret_key"[[:space:]]*:[[:space:]]*"[^"]*"' "$CONFIG_FILE" | cut -d'"' -f4) if [ -n "$API_KEY" ] && [ -n "$SECRET_KEY" ]; then echo "Fetching access_token..." RESPONSE=$(curl -s -X POST "https://aip.baidubce.com/oauth/2.0/token?grant_type=client_credentials&client_id=${API_KEY}&client_secret=${SECRET_KEY}") if echo "$RESPONSE" | grep -q "access_token"; then echo "✓ API connection successful!" else echo "✗ API connection failed. Please verify your API keys." echo " Response: $RESPONSE" fi fi fi ``` ### Technical Analysis The network request is directed to Baidu's declared OAuth service and is consistent with the advertised connection test. The status message `Fetching access_token...` does not itself transmit information, and the reviewed code d ...[truncated 2484 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The feature description emphasizes convenience but does not clearly disclose that cloud OCR requests may upload sensitive images and extracted text to Baidu services. Because this skill handles ID cards, passports, bank cards, invoices, and similar high-sensitivity documents, the missing privacy/transmission warning materially increases the risk of unintentional data disclosure and noncompliant use.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Method 3: Config file
bash mkdir -p ~/.openclaw/skills/BaiduOCR-LocalFallback cat > ~/.openclaw/skills/BaiduOCR-LocalFallback/config.json << 'EOF' { "api_key": "<your_api_key>",
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
"secret_key": "<your_secret_key>" } EOF chmod 600 ~/.openclaw/skills/BaiduOCR-LocalFallback/config.json
text ## Response Format
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script reads the secret key with a normal
read -p, which echoes the credential to the terminal and may expose it to shoulder-surfing, screen recording, terminal logging, or shared session capture. In an installer that explicitly collects API credentials, this is a real confidentiality issue even though it is likely an implementation oversight rather than malicious behavior.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The install flow and security notes indicate persistent storage of Baidu API credentials under ~/.openclaw/skills/BaiduOCR-LocalFallback/config.json. Persisting secrets in a user-accessible plaintext file increases the chance of credential theft via local compromise, backups, misconfigured permissions, or other processes reading the file. The skill context makes this more sensitive because the credentials enable outbound use of a third-party OCR service and the skill handles potentially sensitive document images.
- Content
json "Detect OS (macOS / Linux / Windows)", "Check Python 3.8+", "Install Python dependencies (requests, easyocr, Pillow)", "Create config directory ~/.openclaw/skills/BaiduOCR-LocalFallback/", "Interactive API key configuration (or skip and configure later)", "Test Baidu OCR connection" ],
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh "security": { "warnings": [ "Requires Baidu API Key + Secret Key — do not share credentials", "Stores credentials in plaintext at ~/.openclaw/skills/BaiduOCR-LocalFallback/config.json (chmod 600 recommended)", "Makes outbound network calls to Baidu OCR API and downloads EasyOCR models (~100MB)", "Do not send highly sensitive images to remote OCR without understanding Baidu's data retention policy", "For higher security, use environment variables instead of config file"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
json "security": { "warnings": [ "Requires Baidu API Key + Secret Key — do not share credentials", "Stores credentials in plaintext at ~/.openclaw/skills/BaiduOCR-LocalFallback/config.json (chmod 600 recommended)", "Makes outbound network calls to Baidu OCR API and downloads EasyOCR models (~100MB)", "Do not send highly sensitive images to remote OCR without understanding Baidu's data retention policy", "For higher security, use environment variables instead of config file"
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation tells users to hand troubleshooting over to an AI using an external cloud document link, which expands the skill's trust boundary well beyond OCR functionality. This can lead users to disclose configuration details, logs, credentials, or document contents to an unrelated third-party AI service, creating avoidable data exposure and potential prompt-injection risk from externally hosted content.
- Content