Tencentcloud MultimodalDocParse OCR

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:49 AM UTC
• Version: 1.0.0

Overview

This skill has a legitimate Tencent Cloud OCR purpose, but it can automatically send user documents or uploaded files to external services without clear consent safeguards.

Install only if you are comfortable sending document URLs and document contents to Tencent Cloud OCR, and do not use it automatically on confidential contracts, invoices, resumes, or internal reports without confirming consent. Prefer short-lived private URLs, narrowly scoped Tencent Cloud credentials, a dedicated virtual environment with pinned dependencies, and a private output directory; clean up downloaded ZIP results when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:95

Finding

Unpinned Third-Party SDK Creates a Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:131

Finding

Unbounded and Non-Exclusive Download of Remote Result Archive

Content

View full analysis

str: """下载结果包 ZIP 到本地，返回保存路径。""" os.makedirs(output_dir, exist_ok=True) parsed = urllib.parse.urlparse(result_url) name = os.path.basename(parsed.path) or "multimodal_result.zip" if not name.lower().endswith(".zip"): name = "multimodal_result.zip" target = os.path.join(output_dir, name) try: with urllib.request.urlopen(result_url, timeout=120) as resp: data = resp.read() with open(target, "wb") as f: f.write(data) return target except Exception as e: print(f"结果包下载失败: {e}", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The downloader treats the API-provided result URL and its response as trusted. It reads the entire response into memory with `resp.read()` and imposes no maximum response size. A large or indefinitely streamed response can therefore consume excessive memory before any data is written, and the eventual write can also exhaust disk space. The code does not validate: - That the result URL uses HTTPS. - That redirects remain within an expected host or trust boundary. - The HTTP response status and expected content type. - The ZIP file signature or archive format. - The maximum permitted response size. The destination filename is derived from the remote URL and opened using `"wb"`, which truncates an existing file. There is no exclusive creation, collision avoidance, or symbolic-link protection. If the output directory is shared, writable by another user, or otherwise attacker-influenced, an attacker can pre-create the expected destination as a symbolic link. The write then follows that link and overwrites another file writable by the Skill's process. The ...[truncated 2033 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to upload user-provided local files to externally accessible storage to obtain a URL before calling the OCR API, but it does not require consent or warn about privacy, confidentiality, or regulatory implications. This is especially dangerous because it can cause silent exfiltration of local documents to third-party storage and then to the OCR provider.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

��式 B：600 权限文件 + source（推荐，防命令行留痕）**

bash

printf 'export TENCENTCLOUD_SECRET_ID="你的SecretId"\nexport TENCENTCLOUD_SECRET_KEY="你的SecretKey"\n' > ~/.tc_ocr_cred
chmod 600 ~/.tc_ocr_cred
source ~/.tc_ocr_cred        # 每次新开终端需重新 source

方式 C：写进 shell 配置（一劳永逸，但密钥明文落盘，谨慎使用）

bash

echo 'export TENCENTCLOUD_SECRET_ID="你的SecretId"' >> ~/.bashrc
echo 'export TENCENTCLOUD_SECRET_KEY="你的SecretKey"' >> ~/.bashrc
source ~/.bashrc

Windows (PowerShell)：

powershell

$env:TENCENTCLOUD_SECRET_ID = "你的SecretId"
$env:TENCENTCLOUD_SECRET_KEY = "你的SecretKey"

④ 验证跑通

拿到真实密钥后，先用最小验证确认链路通：

bash

python scripts/main.py --file-url "<一个可公开访问的小PDF的URL>" --download

成功返回含 ResultUrl / RequestId / ExpiresIn 的 JSON 即链路通。

⚠️ 不要把密钥直接�

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares behavior that requires network access and use of environment-stored credentials, but it does not explicitly constrain or disclose its tool scope through permissions or allowed-tools metadata. In an agent setting, this increases the chance of unintended execution with broader capabilities than users or orchestrators expect, especially because the skill also encourages automatic invocation and remote document fetching.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill highlights automatic ZIP download and local persistence of parsing results, including extracted images and structured content, but does not prominently warn that the output may contain sensitive document text, embedded images, and other confidential material. This can lead to unintentional local data exposure, retention, or mishandling on shared systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill applicability section is very broad and covers many ordinary document-related requests, which increases the chance that the skill is selected in situations where external OCR processing is not necessary or expected. In context, this matters because the skill performs networked handling of user-provided documents and may download extracted content locally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The auto-trigger guidance is overly broad, telling the agent to automatically invoke the skill whenever certain URLs, attachments, or common intent phrases are detected. That can cause unintended transmission of user documents to an external OCR service without a sufficiently explicit user confirmation, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

方式 B：600 权限文件 + source（推荐，防命令行留痕）

bash

printf 'export TENCENTCLOUD_SECRET_ID="你的SecretId"\nexport TENCENTCLOUD_SECRET_KEY="你的SecretKey"\n' > ~/.tc_ocr_cred
chmod 600 ~/.tc_ocr_cred
source ~/.tc_ocr_cred        # 每次新开终端需重新 source

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script sends a user-supplied document URL to Tencent Cloud for remote processing, which necessarily discloses the document location and may disclose sensitive content to a third party. While this is the expected function of the skill, the risk is real because the CLI help and behavior do not clearly foreground the privacy and data-transfer implications before transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script performs a local file write when --download is used, creating directories and saving the returned ZIP file. Although the flag help mentions downloading, the top-level script description does not prominently warn that running with this option writes parsed results to local storage, which may matter for sensitive documents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.