T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:67- Finding
Shell Command Injection Through Untrusted Image Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
夸克扫描王 OCR文字识别 - yescan ocr universal
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a genuine Quark OCR skill, but it needs Review because crafted image inputs could be run unsafely as shell commands and sensitive uploads are not tightly scoped.
Install only if you are comfortable sending submitted images, including sensitive documents, to Quark's remote OCR service using your configured API key. Before routine use, the maintainer should change the run instructions to invoke Python with a non-shell argument array and disable or constrain redirects for OCR POST requests. Avoid processing untrusted image URLs, paths, or base64 strings with the current command template.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/common/ocr_client.py:158- Finding
Sensitive API Key and Image Data May Be Replayed Across Redirects
- Content
View full analysis
Dict[str, Any]: """Construct request parameters""" param = { "aiApiKey": self.api_key, "dataType": self.data_type, "scene": self.scene } if base64_data: param["dataBase64"] = base64_data else: param["dataUrl"] = image_url return param def _send_request(self, param: Dict[str, Any]) -> requests.Response: """Send an HTTP request to the OCR API""" headers = {"Content-Type": "application/json", "X-Appbuilder-From": "openclaw"} response = self.session.post( API_URL, json=param, headers=headers, timeout=REQUEST_TIMEOUT, allow_redirects=True ) return response ``` ### Technical Analysis The POST body contains both the `SCAN_WEBSERVICE_KEY` value in `aiApiKey` and either sensitive image content in `dataBase64` or a user-provided image URL. The request explicitly enables automatic redirects. For HTTP 307 and 308 responses, clients preserve the original method and request body. Consequently, if the configured OCR endpoint returns a redirect to another origin, the client may replay the POST body—including the API key and image—to the redirect destination. The initial endpoint uses HTTPS and is the documented OCR provider, which limits ordinary exposure. Exploitation therefore depends on the trusted endpoint, its infrastructure, or the network trust chain causing a redirect to an unauthorized host. Nevertheless, automatically allowing cross-origin replay of credentials and private documents is unnecessary for the Skill's declared OCR operation. The flagged Base64 encoding in this file is not itself covert exfiltration. Encoding a ...[truncated 1331 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is presented as an OCR service, but the analyzed behavior indicates additional local file write and path-handling capabilities that are not clearly disclosed in the description. Hidden or under-documented file persistence is risky because users may submit highly sensitive documents like IDs, licenses, invoices, and medical reports, assuming only transient OCR processing rather than local storage.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill is presented as an OCR service, but the analyzed behavior indicates additional local file write and path-handling capabilities that are not clearly disclosed in the description. Hidden or under-documented file persistence is risky because users may submit highly sensitive documents like IDs, licenses, invoices, and medical reports, assuming only transient OCR processing rather than local storage.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` — 本文档（意图分析 + 通用规范）
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares use of environment variables and a third-party network service, but does not define an explicit tool/permission scope such as allowed tools or permissions. This weakens least-privilege controls and makes it harder for a runtime or reviewer to constrain network access and sensitive env exposure, especially since the skill processes potentially sensitive identity and medical images.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file forces a specific language/locale for all user-facing instructions and examples, and does not indicate that users may choose another language. Under the policy, fixed language behavior without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code reads a local file, base64-encodes its full contents, and submits that data to a remote OCR service. In an OCR skill this is expected functionality, but it still creates a real data-exfiltration risk if users are not clearly informed that local documents, IDs, invoices, or medical records will leave the local environment and be sent to a third-party service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTTP client sends OCR payloads and the API key to an external endpoint, which means user-provided image data and secrets are transmitted off-host. Even though this is core to the service design, the risk is real because the module itself provides no visible notice, consent flow, or safeguards around sensitive content being sent to a third party.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The runner accepts user-supplied image URLs, local file paths, or base64 data and sends them to QuarkOCRClient.recognize(), which likely transmits the content to a remote OCR service. Because this file provides no explicit user-facing warning, consent check, or data-sensitivity guard, users may unintentionally upload sensitive documents such as IDs, invoices, or medical records described in the skill metadata.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This Python file contains human-readable docstrings, comments, and an error message exclusively in Chinese. Under the language/locale policy, forcing a specific language without documented user choice or clear region-specific justification can be a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains natural-language documentation entirely in Chinese, including the module description and later user-facing success/error messages, with no indication that Chinese is optional or required for a specific regional context. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The module description is written entirely in Chinese, and the surrounding user-facing strings in comments/docstrings are also Chinese-only. Under the stated policy, language-specific behavior or presentation should not be forced without opt-in or clear justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language documentation exclusively in Chinese, including the module and function docstrings. Under the stated policy, forcing a specific language without user opt-in or documented justification is a locale/language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The module docstring and inline help text are presented in Chinese only, which can constitute a language policy violation when no opt-in, localization choice, or scope justification is provided. There is no indication that this skill is intentionally limited to a Chinese-speaking or region-specific context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This Python file contains natural-language documentation and comments only in Chinese, including the module docstring and descriptive comments. Under the stated policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code file contains user- and developer-facing natural-language strings and docstrings in Chinese, including the module and validator descriptions. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy concern when no alternative or language choice is offered.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The natural-language description is entirely in Chinese ('夸克扫描王 OCR 识别服务') with no indication that users can choose another language or locale. The policy calls for flagging language or locale constraints when they are imposed without opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.