v1.0.4

TencentCloud IDCard OCR

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 6:35 AM.

Analysis

The skill coherently calls Tencent Cloud’s ID-card OCR service, but users should notice that it sends sensitive ID images and extracted identity details to Tencent Cloud using their API credentials.

GuidanceBefore installing, confirm you are comfortable sending ID-card images or URLs to Tencent Cloud and receiving extracted PII in the agent output. Use a dedicated OCR-scoped Tencent Cloud key, keep credentials out of logs, and pin or verify the Tencent Cloud Python SDK package.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

依赖：`tencentcloud-sdk-python`（通过 `pip install tencentcloud-sdk-python` 安装）

The documented dependency is installed via an unpinned pip command and there is no install spec locking the version. The dependency is expected for this Tencent Cloud integration, but provenance and version are not constrained.

User impactA future or unexpected package version could change behavior compared with what was reviewed.

RecommendationInstall the official Tencent Cloud SDK from a trusted package index and consider pinning a reviewed version.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

scripts/main.py

secret_id = os.environ.get("TENCENTCLOUD_SECRET_ID") ... secret_key = os.environ.get("TENCENTCLOUD_SECRET_KEY") ... cred = credential.Credential(secret_id, secret_key)

The skill uses Tencent Cloud API credentials from environment variables. This is purpose-aligned for calling the OCR service, but cloud credentials are sensitive and the registry metadata lists no required env vars or primary credential.

User impactIf overly broad Tencent Cloud keys are supplied, anyone invoking the skill in that environment may be able to use those credentials for OCR calls.

RecommendationUse a dedicated, least-privilege Tencent Cloud credential for OCR only, avoid root or broadly privileged keys, and store the environment variables securely.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

scripts/main.py

http_profile.endpoint = "ocr.tencentcloudapi.com" ... req.ImageUrl = args.image_url ... req.ImageBase64 = load_image_base64(args.image_base64) ... resp = client.IDCardOCR(req)

The user-provided ID image URL or Base64/local image content is sent to Tencent Cloud’s OCR API. This is expected for the stated purpose, but it crosses an external provider data boundary with sensitive identity data.

User impactID-card images, image URLs, and extracted fields such as name, address, and ID number may be processed by Tencent Cloud.

RecommendationUse only with proper consent and a Tencent Cloud account you trust; review Tencent Cloud’s OCR data handling terms and avoid submitting unnecessary identity documents.