TencentCloud General OCR

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  1.0.2

Overview

This appears to be a purpose-built Tencent Cloud OCR skill, with the main risk being under-disclosed third-party processing of user images rather than hidden or destructive behavior.

Install only if you are comfortable having OCR inputs, including image contents or image URLs, processed by Tencent Cloud. Avoid using it for IDs, financial documents, medical records, customer data, or confidential business images unless you have consent and have reviewed Tencent Cloud privacy, retention, and compliance requirements.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger conditions are overly broad, including phrases like any OCR-related scenario, which can cause the skill to activate for requests that do not clearly require this specific external service. Overbroad invocation increases the chance of unnecessary transmission of user images or URLs to Tencent Cloud, creating privacy, cost, and consent risks.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill does not clearly warn users that supplied image content or image URLs are sent to Tencent Cloud for processing. Because images may contain personal, confidential, or regulated information, omission of this disclosure undermines informed consent and can lead to unintended third-party data exposure.

VirusTotal

64/64 vendors flagged this skill as clean.