v1.0.2

TencentCloud BizLicense OCR

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 6:34 AM.

Analysis

This appears to be a straightforward TencentCloud OCR wrapper, but users should know it needs TencentCloud credentials and sends the provided license image or URL to TencentCloud.

GuidanceBefore installing, confirm you are comfortable providing TencentCloud API credentials and sending the selected business license images or URLs to TencentCloud for processing. Use a dedicated cloud key if possible, protect the environment variables, and install the TencentCloud SDK from a trusted source.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

SKILL.md

依赖：`tencentcloud-sdk-python`（通过 `pip install tencentcloud-sdk-python` 安装）

The skill relies on a Python package installed by name without a pinned version. This is a normal dependency for TencentCloud integration, but it leaves package provenance and version selection to the user's environment.

User impactInstalling the dependency from an untrusted or changing package source could affect the behavior of the skill.

RecommendationInstall the SDK from the official package index or a trusted mirror, and consider pinning a known-good version in controlled environments.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

scripts/main.py

secret_id = os.environ.get("TENCENTCLOUD_SECRET_ID")
secret_key = os.environ.get("TENCENTCLOUD_SECRET_KEY")
...
cred = credential.Credential(secret_id, secret_key)

The script requires TencentCloud API credentials and uses them to create the OCR client. This is expected for TencentCloud OCR, but it means requests run under the user's TencentCloud account.

User impactUsing the skill may consume TencentCloud OCR quota or incur charges under the configured account.

RecommendationUse a dedicated, least-privilege TencentCloud key for OCR, keep the environment variables private, and monitor account usage.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

scripts/main.py

http_profile.endpoint = "ocr.tencentcloudapi.com"
...
req.ImageUrl = args.image_url
...
req.ImageBase64 = load_image_base64(args.image_base64)
...
resp = client.BizLicenseOCR(req)

The code sends either an image URL or Base64-encoded image content to TencentCloud's OCR endpoint. This is the intended service flow, but it is an external data transfer.

User impactBusiness license images and extracted business details may be processed by TencentCloud.

RecommendationOnly submit documents you are authorized to upload to TencentCloud, and review TencentCloud's data handling terms for sensitive business documents.