TencentCloud ExtractDoc OCR

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:49 AM UTC
• Version: 1.0.2

Overview

This skill is a straightforward Tencent Cloud OCR helper, but users should treat uploaded documents and cloud credentials as sensitive.

Install only if you are comfortable sending selected documents or document URLs to Tencent Cloud OCR and using Tencent Cloud API credentials in the runtime environment. Use narrowly scoped credentials, avoid processing highly sensitive contracts or invoices without approval, and prefer a pinned SDK version or isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:37

Finding

Unpinned Third-Party SDK Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:37; scripts/main.py:229-233
Vulnerability Type: Unpinned third-party dependency and supply-chain exposure
Risk Level: Low

Vulnerable Code

SKILL.md:37:

text

pip install tencentcloud-sdk-python

scripts/main.py:229-233:

python

except ImportError:
    print(
        "Error: Missing dependency tencentcloud-sdk-python; run: pip install tencentcloud-sdk-python",
        file=sys.stderr,
    )

The original message in the source code is written in Chinese but gives the same unpinned installation instruction shown above.

Technical Analysis

The Skill directs users to install tencentcloud-sdk-python without specifying an exact reviewed version, package hash, or lockfile. Consequently, the installed code depends on mutable package-registry state at installation time rather than the version reviewed with this Skill.

The SDK is imported by scripts/main.py and executes in the same process as the Skill. It can therefore access the process environment, including TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY, as well as document data supplied for OCR processing. This creates supply-chain exposure if the upstream package, maintainer account, release pipeline, or package repository is compromised.

No evidence was found that the current Skill deliberately installs a malicious or lookalike package. The risk arises from the absence of version and integrity controls.

Attack Path

1. An attacker compromises the upstream package maintainer account, release pipeline, distribution repository, or a future dependency release.
2. The attacker publishes a malicious version under the legitimate package name.
3. A user follows the Skill documentation or runtime error message and runs the unpinned installation command.
4. The package manager selects the attacker-controlled release.
5. When scripts/main.py imports the SDK, malicious initialization code executes with the invokin ...[truncated 822 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact version that has been reviewed:

text

tencentcloud-sdk-python==REVIEWED_VERSION

2. Maintain dependencies in a requirements or lock file rather than instructing users to install an unconstrained package.
3. Generate and enforce cryptographic hashes, for example with pip's --require-hashes option.
4. Install packages only from the official Python package index or an organization-controlled, authenticated package mirror.
5. Add automated dependency vulnerability scanning and review updates before changing the pinned version.
6. Run the Skill in an isolated environment with only the required credentials, files, and network access.
7. Update both SKILL.md and the runtime dependency error message so they reference the pinned, integrity-verified installation procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes extracting data from uploaded images and PDFs via Tencent Cloud OCR but does not warn that document contents will be transmitted to a third-party cloud service. Because the supported documents include contracts, invoices, and reports, this omission can lead to unintentional disclosure of sensitive personal, financial, or confidential business information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill references environment-based credentials and an executable script, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, missing scope metadata can cause the skill to be invoked with broader-than-necessary access to environment secrets, increasing the chance of credential exposure or unintended external API use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions are very broad, including phrases like any scenario involving document extraction, which can cause over-invocation of the skill. In practice this may send documents to an external OCR service when a local/manual alternative would be more appropriate, increasing unnecessary data exposure and cost.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to provide Tencent Cloud secret credentials through environment variables but does not warn against exposing, logging, or embedding those secrets in prompts, scripts, or repositories. This creates a realistic path to credential leakage, which could enable unauthorized API usage, billing abuse, or broader compromise of the associated cloud account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.