T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/ocr_image.py:9
- Finding
- Undocumented Plaintext Persistence and Silent Overwrite of OCR Results## Vulnerability Details **File Location**: `scripts/ocr_image.py`, lines 9 and 35-38 **Vulnerability Type**: Unexpected plaintext storage of potentially sensitive OCR data **Risk Level**: Medium ### Vulnerable Code ```python img_name = os.path.splitext(os.path.basename(img_path))[0] output_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), f'{img_name}_ocr.txt') ``` ```python if 'ParsedResults' in result: with open(output_path, 'w', encoding='utf-8') as f: for r in result['ParsedResults']: f.write(r['ParsedText']) print(f'[OCR识别完成，保存到 {output_path}]') ``` ### Technical Analysis The packaged script automatically writes OCR output to a predictable plaintext file under the Skill's `scripts` directory. This differs from the documented workflow in `SKILL.md`, which states that the recognition result is returned and whose embedded example prints the result rather than persisting it. OCR output may contain credentials, personal information, financial records, or other confidential text extracted from an image. Automatically retaining that text creates an unexpected data artifact. The use of write mode (`'w'`) also silently truncates an existing file with the same generated name. The static pre-scan's Base64 concern was reviewed separately. The image is converted to JPEG, Base64-encoded, and submitted over HTTPS to the explicitly declared OCR.space API. Base64 is required as part of the API payload format and is not used here to conceal unrelated data. No collection of credentials, environment variables, or unrelated local files was identified. ### Attack Path 1. A user invokes the Skill with an image containing sensitive information. 2. The script opens and transforms the selected image. 3. The transformed image is sent to the declared OCR.space endpoint for recognition. 4. The returned OCR text is written automatically to `scripts/<image-name>_ocr.txt`. 5. Any local user or process able to read that location ma ...[truncated 681 chars]
- Remediation
- ## Remediation Suggestions - Return OCR text to standard output by default, matching the documented behavior. - Require an explicit command-line option before writing results to disk. - Let the caller choose the destination instead of writing into the installed Skill directory. - Refuse to overwrite an existing file unless an explicit overwrite flag is supplied. - Create output files with restrictive permissions where supported. - Clearly document data retention, destination, overwrite behavior, and the fact that selected images are transmitted to OCR.space. - Warn users not to submit sensitive images unless third-party processing and retention terms are acceptable. - Handle partial API responses and file-writing errors without leaving misleading or incomplete artifacts.