TencentCloud RecognizeTable OCR

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:47 AM UTC
• Version: 1.0.2

Overview

This skill is a straightforward Tencent Cloud table OCR helper with expected cloud credential use and document submission, though users should treat its inputs as sent to Tencent Cloud.

Install this only if you are comfortable providing Tencent Cloud OCR credentials and sending the selected image/PDF content or URL to Tencent Cloud for processing. Use narrowly scoped Tencent credentials, install the SDK in an isolated environment, and prefer a pinned dependency version where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Third-Party SDK Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 40
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

- Dependency: `tencentcloud-sdk-python` (install via `pip install tencentcloud-sdk-python`)

Technical Analysis

The installation instructions specify the tencentcloud-sdk-python package without pinning a reviewed version or requiring integrity hashes. Consequently, installation resolves to whichever compatible release the configured package index provides at that time.

The dependency is imported and used by scripts/main.py to process Tencent Cloud credentials and user-supplied OCR documents. A malicious or compromised future package release could therefore execute code with the privileges of the user running the Skill. This is a supply-chain exposure rather than evidence that the currently named Tencent Cloud package is malicious.

The flagged Base64 processing in scripts/main.py was also reviewed. It supports the documented OCR protocol by encoding a user-selected image or PDF for submission to ocr.tencentcloudapi.com, and by decoding returned Excel data when requested. No credential encoding, hidden destination, covert exfiltration channel, persistence mechanism, or embedded malicious payload was identified.

Attack Path

1. An attacker compromises the package publisher, the package registry, a dependency release, or the package index used by the operator.
2. The attacker publishes a malicious version that remains compatible with the unpinned package requirement.
3. A user follows the documented pip install tencentcloud-sdk-python command.
4. The package manager installs the attacker-controlled release because no exact version or integrity hash is enforced.
5. Malicious package code executes during installation or when scripts/main.py imports the SDK.
6. The malicious code can access data available to the Skill process, p ...[truncated 758 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the SDK to an exact version that has been reviewed and tested, for example:

   text

   tencentcloud-sdk-python==<reviewed-version>
   

2. Maintain dependencies in a version-controlled requirements or lock file rather than relying only on an ad hoc installation command.

3. Generate and enforce package hashes, such as by using pip install --require-hashes -r requirements.txt.

4. Install packages exclusively from an explicitly configured, trusted package index.

5. Use automated dependency scanning and controlled update reviews before changing the pinned version.

6. Run the Skill under a least-privileged account and restrict the Tencent Cloud credentials to only the OCR permissions required by this functionality.

7. Prefer an isolated virtual environment or container with narrowly scoped filesystem and network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly relies on environment variables for cloud credentials but does not declare any tool scope, permissions, or allowed-tools boundary. That omission weakens least-privilege controls and makes it harder for a host agent to constrain environment access, increasing the chance of unintended secret exposure or unauthorized execution context use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill handles images and PDFs that may contain sensitive business or personal data, and it sends them to a third-party cloud OCR service, but the description does not warn users about that privacy impact. In this skill's context, that omission is more dangerous because document OCR commonly processes confidential records, invoices, statements, and internal reports.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger conditions include very broad language such as applying to 'any table OCR recognition scenario,' which can cause the skill to be invoked in situations the user did not intend. In this context, accidental invocation is security-relevant because it may upload sensitive images or PDFs to Tencent Cloud without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s docstrings, CLI descriptions, help text, and runtime messages are all hard-coded in Chinese, which imposes a specific language on users without any opt-in or alternative locale selection. This matches the policy category for language or locale constraints that are not documented as optional or region-justified for the user interface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

描述中多次声明“支持中英文表格图片”，从自然语言上形成了语言范围限制，但未说明这是底层服务能力边界，也未引导用户根据文档语言自行判断适用性。按组织语言/locale政策，这类语言限制应有明确说明或用户选择机制，避免不必要地默认排除其他语言场景。

Content

No source excerpt is available for this finding.