T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.js:1749- Finding
Arbitrary Local Image and PDF Disclosure Through Untrusted Context Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
vision ocr
Security checks for vulnerabilities and agentic risk
Overview
This OCR skill is coherent and mostly disclosed, but it needs Review because its file/context handling and optional remote attachment flow can expose sensitive documents or credentials if used in a permissive integration.
Install only if you trust the configured OCR/multimodal providers and understand that document contents may be sent to them. Keep Feishu auto-send, remote input, and OpenClaw session recovery disabled unless needed; avoid using this in shared or untrusted chat integrations until local file paths are restricted to trusted upload directories, remote downloads use an allowlist without ambient auth headers, redirects/DNS are validated, and config.json secrets are protected with owner-only permissions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
index.js:1820- Finding
Authorization Headers and Cookies Can Be Forwarded to Attacker-Controlled Attachment Hosts
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
index.js:1912- Finding
Remote Attachment SSRF Protection Is Bypassable Through DNS and Redirects
- Content
View full analysis
p < 0 || p > 255)) return false; const [a, b] = parts; if (a === 10) return true; if (a === 127) return true; if (a === 169 && b === 254) return true; if (a === 172 && b >= 16 && b <= 31) return true; if (a === 192 && parts[1] === 168) return true; return false; } // IPv6 const ipv6 = hostname.toLowerCase(); if (ipv6 === '::1' || ipv6 === '0:0:0:0:0:0:0:1') return true; if (ipv6.startsWith('fc') || ipv6.startsWith('fd')) return true; return false; } function isSupportedRemoteUrl(value) { if (typeof value !== 'string') return false; try { const url = new URL(value); if (!['http:', 'https:'].includes(url.protocol)) return false; const hostname = url.hostname.toLowerCase(); if (hostname === 'localhost' || isPrivateIpAddress(hostname)) { return false; } return true; } catch (error) { return false; } } ``` ```javascript async function downloadRemoteInputFile(candidate) { if (!candidate?.url) { return null; } if (!isSupportedRemoteUrl(candidate.url)) { throw new Error(`Remote attachment URL is unsafe: ${candidate.url}`); } const headers = new Headers(candidate.headers || {}); const controller = new AbortController(); const timeout = setTimeout(() => controller.abort(), MAX_REMOTE_FETCH_TIMEOUT_MS); let response; try { response = await fetch(candidate.url, { headers, signal: controller.signal }); } finally { clearTimeout(timeout); } ``` ### Technical Analysis The URL filter checks only the textual hostn ...[truncated 2220 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
update-config.js:42- Finding
API Tokens Are Persisted Without Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description focuses on OCR/Markdown generation, but the documented behavior also includes recovering session/recipient information from runtime files and environment variables, parsing message context including headers/auth-related fields, downloading remote attachments, and invoking another skill to send files. These extra behaviors materially expand the trust boundary and can expose sensitive metadata, enable data exfiltration, or trigger cross-skill actions that a user may not expect from an OCR skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description focuses on OCR/Markdown generation, but the documented behavior also includes recovering session/recipient information from runtime files and environment variables, parsing message context including headers/auth-related fields, downloading remote attachments, and invoking another skill to send files. These extra behaviors materially expand the trust boundary and can expose sensitive metadata, enable data exfiltration, or trigger cross-skill actions that a user may not expect from an OCR skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description focuses on OCR/Markdown generation, but the documented behavior also includes recovering session/recipient information from runtime files and environment variables, parsing message context including headers/auth-related fields, downloading remote attachments, and invoking another skill to send files. These extra behaviors materially expand the trust boundary and can expose sensitive metadata, enable data exfiltration, or trigger cross-skill actions that a user may not expect from an OCR skill.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js return false; } return promptText === DEEPSEEK_PROMPTS.handwriting || HANDWRITING_KEYWORD_REGEX.test(promptText); } function stripMarkdownSyntax(line) {
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
js process.exit(missingFields.length === 0 ? 0 : 1); } const hasVisionEnv = Object.keys(process.env).some(name => name.startsWith('VISION_')); if (!forceUpdate && !hasVisionEnv) { log('未检测到任何 VISION_* 环境变量，未改写本地配置。', 'WARN'); console.log('\n如需写入本地 config.json，请先设置对应的 VISION_* 环境变量，再运行该命令。');
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
文件从开头起即以中文描述技能能力，通篇示例、参数说明和使用说明也全部使用中文，但没有说明这是面向特定中文用户群的区域性技能，也没有提供其他语言或用户选择。根据规则，强制特定语言而无用户选择或合理限定，属于自然语言层面的语言/区域策略风险。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill documentation declares capabilities involving environment variables, networked OCR/multimodal services, runtime session recovery, and optional Feishu delivery, but it does not define any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity: a host may grant broader-than-necessary env/network access, increasing the chance of unintended data exposure or misuse if the skill is invoked in a permissive environment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger examples include broad natural-language phrases such as 'OCR 这个截图' and '识别图片', which can overlap with ordinary conversation and cause accidental activation. In a skill that may access files, perform network requests, infer recipients, and optionally send results outward, unintended triggering raises the risk of processing or disclosing sensitive documents without sufficiently deliberate user intent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code infers delivery recipients from OPENCLAW_* environment variables and from ~/.openclaw/runtime.json, then uses that identity to route recognized document contents to Feishu. This creates a cross-context data exposure risk: OCR results from one invocation may be sent to an unintended user or group if runtime metadata is stale, poisoned, or incorrectly populated.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill can discover remote attachment URLs from message/context objects and, when enabled, automatically download them with optional Authorization/Cookie/Referer headers inherited from runtime context. This expands the trust boundary from user-provided local files to network retrieval and can be abused for unintended outbound requests, sensitive header leakage to third-party hosts, and processing attacker-controlled remote content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The package description is written entirely in Chinese and presents the skill behavior in a single locale without indicating user choice or multilingual support. This may violate language/locale policy if the skill is expected to operate in a user-selected language rather than implicitly defaulting to Chinese.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest advertises optional automatic sending to Feishu, but the description does not prominently warn that recognized document contents may be transmitted to an external chat destination. For an OCR skill handling screenshots, scans, invoices, and technical documents, this raises meaningful confidentiality and privacy risks if users do not clearly understand where extracted data will go.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The contains-match trigger "识别" is extremely generic for Chinese-language conversations and can activate the skill in many contexts unrelated to OCR. In a skill that can process documents and optionally transmit extracted content to Feishu, unintended activation increases the chance of accidental data handling or disclosure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The contains trigger "OCR" is broad and likely to match routine discussion about OCR rather than explicit requests to run this skill. This can cause unintended invocation of a capability that sends content to external OCR/multimodal services, creating unnecessary exposure of user data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The trigger "截图" is ambiguous because users may mention screenshots conversationally without requesting OCR. By itself this is less dangerous than a direct send action, but in this skill context it can still lead to accidental processing of image content by remote services.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The contains trigger "PDF" is overly broad because users frequently mention PDFs without asking for OCR or document conversion. In this skill, broad PDF-triggered activation can cause unintended ingestion of potentially sensitive documents and transmission to configured OCR/multimodal endpoints.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The skill documentation and usage instructions consistently assume Chinese, but there is no statement that the skill supports multiple languages or that Chinese is an intentional, user-selected locale. This can violate language/locale policy when users are not given a choice or informed of the constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The placeholder strings for the configuration fields are written entirely in Chinese, which imposes a specific language/locale in user-facing natural language content. The file does not offer an alternative language choice or document a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code formats recognition timestamps with
toLocaleString('zh-CN'), which forces a specific language/locale in user-visible output. This is a natural-language locale choice embedded in the skill and does not appear to offer user opt-in or configuration.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The generated markdown for OCR-only results includes a timestamp produced with
toLocaleString('zh-CN'), forcing Chinese locale formatting. The file does not show a user-selectable language/locale option for this user-facing text.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The generated markdown for image results uses
toLocaleString('zh-CN'), which imposes a specific locale in output formatting. This is a language/locale policy issue because no opt-in or documented locale constraint is present in the file.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The comment states robot mode 'only trusts explicit recipients or current context.session' to avoid additional runtime-file-based recipient inference. However, the actual logic also parses recipient overrides from free-form user text and later passes that recipient into delivery logic, so the documented trust model is narrower than the implemented behavior.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This manifest file contains only a broad capability description of the OCR skill and does not indicate how or when it should be invoked, nor any constraints or exclusion conditions. In manifest-style metadata, the absence of trigger specificity can contribute to unintended invocation if downstream tooling uses the description as activation guidance.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code writes PNG files to paths derived from user input, but the function contains no confirmation prompt, comment/docstring, or user-facing disclosure about creating files. For a code file, file writes are safety-relevant operations that should have some visible warning unless the operation is clearly documented elsewhere, which is not present in this file.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The optimize_image path saves a transformed image to the provided output path, but there is no confirmation prompt, comment/docstring, or user-facing notice describing that a file will be written. This is a safety-critical file-write operation under the rule's code-file criteria.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- index.js:1606
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.js:21