Security audit

夸克扫描王 - OCR文字识别 Alibaba-Quark-OCR

Security checks for vulnerabilities and agentic risk

Overview

This OCR skill is purpose-aligned and discloses that uploaded images are sent to Quark's remote OCR service, but users should treat sensitive documents carefully.

Install only if you are comfortable sending the images you provide, including IDs, invoices, and medical documents, to Quark's OCR service using your API key. Review the provider's retention/privacy terms, protect SCAN_WEBSERVICE_KEY, and avoid using the skill for documents you cannot share with that third party.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 86% confidence
Finding: The skill is presented as OCR-only, but the referenced behavior includes image enhancement/editing, document conversion, and saving returned files locally. That broadens data handling and file-write capabilities beyond user expectations, increasing risk of unintended sensitive-document transformation, local artifact leakage, and policy bypass where a supposedly extraction-only skill performs editing/export operations.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill manifest describes an OCR/text-extraction tool, but this configuration enables additional image-enhancement and document-conversion operations such as watermark removal, handwriting removal, and image-to-document conversion. This scope expansion can bypass user and platform expectations, increasing the risk that the skill is invoked for editing or content-manipulation tasks outside its declared purpose, including potentially abusive transformations.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger condition says the skill should activate even when the user does not explicitly mention OCR, as long as the request involves obtaining text or key information from an image. That breadth can cause over-triggering on ordinary image-related conversations and route sensitive IDs, medical reports, or business documents to a third-party OCR endpoint without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The client reads local files or accepts base64/image URLs and sends the full image contents to a remote OCR API, but this module provides no built-in consent, disclosure, or sensitivity checks before transmitting potentially private documents. In the context of an OCR skill explicitly targeting IDs, licenses, invoices, medical reports, and other sensitive records, silent transmission to a third-party service creates a real privacy and data-handling risk even if it is the intended product behavior.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This runner accepts a user-supplied URL, local file path, or base64 image and sends it to a remote OCR service via QuarkOCRClient without any visible consent, trust-boundary warning, or validation in this file. Because the supported use cases include highly sensitive documents such as IDs, medical reports, licenses, and invoices, users may unknowingly transmit confidential data off-host, creating a real privacy and data-handling risk even if this is the intended product behavior.

Static analysis

No suspicious patterns detected.