Security audit

夸克扫描王-OCR 文字识别/文件扫描/转 Office Alibaba-Quark-Scanking-All

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Quark Scan image/document processing, but it deserves review because it can automatically install or upgrade an unpinned CLI while handling sensitive files and API credentials.

Review before installing. Use this only if you are comfortable sending selected images or documents to Quark Scan, store the API key only in an account you trust, prefer an isolated virtual environment with a pinned yescan version, and clean generated files from temp directories after processing sensitive content.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.en.md:15
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation
``` Install it with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Remove mandatory automatic upgrades from the skill workflow. Require explicit user approval before installing a different release. 4. Review each new package version before updating the pinned version and hashes. 5. Install the dependency in an isolated virtual environment with minimal filesystem and network permissions. 6. Prefer a trusted, controlled package mirror where release provenance and integrity are enforced. 7. Document the exact package source, expected publisher identity, version, and artifact digest. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SECURITY.md:22
Finding: Sensitive Processing Results Persist in Shared Temporary Directories
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description is explicitly over-broad: it says image/document-related requests should trigger this skill even when the user has not named a specific function, covering OCR, translation, enhancement, conversion, and ID-photo generation. That increases the chance of unintended activation on ordinary image tasks, causing unnecessary network transfer of user files to an external service and potentially exposing sensitive documents without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README promotes uploading images and documents to a cloud-powered processing service but does not clearly warn that user files may be transmitted to an external provider for remote processing. In an agent context, this can cause sensitive IDs, invoices, handwritten notes, or other private documents to be sent off-device without the operator realizing the privacy and compliance implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README promotes OCR, ID card processing, invoice extraction, and image enhancement workflows that inherently involve sensitive personal or business documents, but it does not provide an explicit privacy warning at the point of use. Although it links to a separate privacy document, users reading only the README may invoke the external Quark scanning service without understanding that their images/documents are transmitted off-device, increasing the risk of unintended disclosure of personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description is entirely in Chinese and presents the skill behavior as Chinese-localized by default, but does not offer a language choice or explain that the skill is restricted to Chinese-speaking users or a China-specific deployment. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file states that the CLI loads SCAN_WEBSERVICE_KEY and POSTs the provided input to https://scan-business.quark.cn/vision, but it does not include any caution about transmitting user files/URLs or using credentials. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors affecting user data, privacy, or system integrity.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The primary README content is presented in Chinese, and the document does not tell users they can choose another language or direct them upfront to an English alternative. Since language-policy findings apply to all file types, forcing a single language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The file explains that outputs may be written to stdout, temporary directories, or an --output directory, including image and document artifacts, but it does not explicitly warn users that running the skill can create local files. For markdown files, disk-affecting behavior should be disclosed when omitted from the skill description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file uses only Chinese for headings, troubleshooting steps, and user guidance. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.