Tencentcloud MultimodalDocParse OCR

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:49 AM UTC
• Version: 1.0.0

Overview

This skill has a legitimate Tencent Cloud OCR purpose, but it can automatically send user documents or uploaded files to external services without clear consent safeguards.

Install only if you are comfortable sending document URLs and document contents to Tencent Cloud OCR, and do not use it automatically on confidential contracts, invoices, resumes, or internal reports without confirming consent. Prefer short-lived private URLs, narrowly scoped Tencent Cloud credentials, a dedicated virtual environment with pinned dependencies, and a private output directory; clean up downloaded ZIP results when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:95
• Finding: Unpinned Third-Party SDK Creates a Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 95-96; additional installation guidance in `scripts/main.py`, lines 218-221 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Complete Code Snippet From `SKILL.md`, lines 95-96: ```markdown - Python 3.6+ - 依赖：`tencentcloud-sdk-python`（通过 `pip install tencentcloud-sdk-python` 安装） ``` Related guidance from `scripts/main.py`, lines 218-221: ```python print( "错误: 缺少依赖 tencentcloud-sdk-python，请执行: pip install tencentcloud-sdk-python", file=sys.stderr, ) ``` ### Technical Analysis The Skill directs users to install `tencentcloud-sdk-python` without specifying a reviewed version, lock file, integrity hash, or trusted package-index configuration. Consequently, the package version and its transitive dependency graph can change after this Skill has been audited. Python packages may execute code during installation and whenever imported. This script imports the SDK immediately before reading and using Tencent Cloud credentials. A compromised future package release, compromised package index, unsafe index configuration, or malicious transitive dependency could therefore execute with the same privileges as the user running the Skill. The package name itself matches the declared Tencent Cloud dependency, so there is no evidence of intentional typosquatting or a presently malicious package. The issue is the absence of reproducible and integrity-verified dependency resolution. ### Attack Path 1. An attacker compromises a future SDK or transitive dependency release, or influences the package source used by the victim's Python environment. 2. A user follows the documented `pip install tencentcloud-sdk-python` instruction. 3. The package manager resolves and installs the attacker-controlled version because no version or hash is constrained. 4. Malicious code executes during installation or when the script imports the package. 5. The malicious dependency can ...[truncated 824 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the SDK and all transitive dependencies to reviewed versions in a lock file. 2. Use hash-verified installation, such as a requirements file containing `--hash` entries and installation with `pip install --require-hashes`. 3. Explicitly use the official Python package index or an organization-controlled, authenticated package mirror. 4. Install the dependency in a dedicated virtual environment with no unnecessary packages. 5. Add automated dependency vulnerability and provenance scanning to the release process. 6. Upgrade dependencies through a controlled review process rather than resolving the newest available versions at runtime. 7. Run the Skill under a minimally privileged operating-system account and use Tencent Cloud credentials restricted to only the required OCR operations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:131
• Finding: Unbounded and Non-Exclusive Download of Remote Result Archive<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py`, lines 131-149 **Vulnerability Type**: Unsafe remote-file download and local-file handling **Risk Level**: Medium ### Complete Code Snippet ```python def download_result_zip(result_url: str, output_dir: str) -> str: """下载结果包 ZIP 到本地，返回保存路径。""" os.makedirs(output_dir, exist_ok=True) parsed = urllib.parse.urlparse(result_url) name = os.path.basename(parsed.path) or "multimodal_result.zip" if not name.lower().endswith(".zip"): name = "multimodal_result.zip" target = os.path.join(output_dir, name) try: with urllib.request.urlopen(result_url, timeout=120) as resp: data = resp.read() with open(target, "wb") as f: f.write(data) return target except Exception as e: print(f"结果包下载失败: {e}", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The downloader treats the API-provided result URL and its response as trusted. It reads the entire response into memory with `resp.read()` and imposes no maximum response size. A large or indefinitely streamed response can therefore consume excessive memory before any data is written, and the eventual write can also exhaust disk space. The code does not validate: - That the result URL uses HTTPS. - That redirects remain within an expected host or trust boundary. - The HTTP response status and expected content type. - The ZIP file signature or archive format. - The maximum permitted response size. The destination filename is derived from the remote URL and opened using `"wb"`, which truncates an existing file. There is no exclusive creation, collision avoidance, or symbolic-link protection. If the output directory is shared, writable by another user, or otherwise attacker-influenced, an attacker can pre-create the expected destination as a symbolic link. The write then follows that link and overwrites another file writable by the Skill's process. The ...[truncated 2033 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for result URLs and reject unsupported schemes. 2. Apply an allowlist for expected result-storage hosts where the service contract permits it. 3. Validate every redirect and reject redirects to untrusted schemes or destinations. 4. Stream the response in fixed-size chunks rather than calling unbounded `resp.read()`. 5. Enforce a strict maximum download size using both `Content-Length`, when available, and a counter over streamed bytes. 6. Write to a randomly named temporary file in a private directory. 7. Create files atomically and exclusively using secure flags such as `O_CREAT | O_EXCL`, with platform-appropriate symbolic-link protection such as `O_NOFOLLOW`. 8. Refuse to overwrite existing destinations and atomically rename the verified temporary file into place. 9. Create the output directory with restrictive permissions and reject unsafe shared or symbolic-link directory components where practical. 10. Verify the downloaded file begins with an accepted ZIP signature and, where possible, validate the complete archive before reporting success. 11. Delete partial files on timeout, validation failure, or other exceptions. 12. Apply process-level memory, disk, and execution-time limits as defense in depth. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to upload user-provided local files to externally accessible storage to obtain a URL before calling the OCR API, but it does not require consent or warn about privacy, confidentiality, or regulatory implications. This is especially dangerous because it can cause silent exfiltration of local documents to third-party storage and then to the OCR provider.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

��式 B：600 权限文件 + source（推荐，防命令行留痕）**
```bash
printf 'export TENCENTCLOUD_SECRET_ID="你的SecretId"\nexport TENCENTCLOUD_SECRET_KEY="你的SecretKey"\n' > ~/.tc_ocr_cred
chmod 600 ~/.tc_ocr_cred
source ~/.tc_ocr_cred        # 每次新开终端需重新 source
```

**方式 C：写进 shell 配置（一劳永逸，但密钥明文落盘，谨慎使用）**
```bash
echo 'export TENCENTCLOUD_SECRET_ID="你的SecretId"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="你的SecretKey"' >> ~/.bashrc
source ~/.bashrc
```

**Windows (PowerShell)：**
```powershell
$env:TENCENTCLOUD_SECRET_ID = "你的SecretId"
$env:TENCENTCLOUD_SECRET_KEY = "你的SecretKey"
```

### ④ 验证跑通

拿到真实密钥后，先用最小验证确认链路通：

```bash
python scripts/main.py --file-url "<一个可公开访问的小PDF的URL>" --download
```

成功返回含 `ResultUrl` / `RequestId` / `ExpiresIn` 的 JSON 即链路通。

⚠️ **不要**把密钥直接�

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares behavior that requires network access and use of environment-stored credentials, but it does not explicitly constrain or disclose its tool scope through permissions or allowed-tools metadata. In an agent setting, this increases the chance of unintended execution with broader capabilities than users or orchestrators expect, especially because the skill also encourages automatic invocation and remote document fetching.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill highlights automatic ZIP download and local persistence of parsing results, including extracted images and structured content, but does not prominently warn that the output may contain sensitive document text, embedded images, and other confidential material. This can lead to unintentional local data exposure, retention, or mishandling on shared systems.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill applicability section is very broad and covers many ordinary document-related requests, which increases the chance that the skill is selected in situations where external OCR processing is not necessary or expected. In context, this matters because the skill performs networked handling of user-provided documents and may download extracted content locally.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The auto-trigger guidance is overly broad, telling the agent to automatically invoke the skill whenever certain URLs, attachments, or common intent phrases are detected. That can cause unintended transmission of user documents to an external OCR service without a sufficiently explicit user confirmation, creating privacy and data-handling risk.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**方式 B：600 权限文件 + source（推荐，防命令行留痕）**
```bash
printf 'export TENCENTCLOUD_SECRET_ID="你的SecretId"\nexport TENCENTCLOUD_SECRET_KEY="你的SecretKey"\n' > ~/.tc_ocr_cred
chmod 600 ~/.tc_ocr_cred
source ~/.tc_ocr_cred        # 每次新开终端需重新 source
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script sends a user-supplied document URL to Tencent Cloud for remote processing, which necessarily discloses the document location and may disclose sensitive content to a third party. While this is the expected function of the skill, the risk is real because the CLI help and behavior do not clearly foreground the privacy and data-transfer implications before transmission.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The script performs a local file write when --download is used, creating directories and saving the returned ZIP file. Although the flag help mentions downloading, the top-level script description does not prominently warn that running with this option writes parsed results to local storage, which may matter for sensitive documents.

Static analysis

No suspicious patterns detected.