v1.0.2

TencentCloud LicensePlate OCR

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 6:35 AM.

Analysis

The skill appears to do the claimed Tencent Cloud license-plate OCR task, but it sends submitted vehicle images to Tencent Cloud and uses your Tencent API keys.

GuidanceBefore installing, make sure you are comfortable sending vehicle images or image URLs to Tencent Cloud, use a restricted Tencent Cloud API key, and install the Tencent SDK from a trusted source, preferably pinned in a virtual environment.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

SKILL.md

依赖：`tencentcloud-sdk-python`（通过 `pip install tencentcloud-sdk-python` 安装）

The skill depends on an external Python SDK installed via pip, with no pinned version shown in the artifacts; this is normal for a Tencent Cloud integration but is still a supply-chain consideration.

User impactInstalling an unpinned package can change behavior over time if the dependency updates.

RecommendationInstall the SDK in a virtual environment from a trusted package source and consider pinning a known-good version.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

scripts/main.py

secret_id = os.environ.get("TENCENTCLOUD_SECRET_ID")
secret_key = os.environ.get("TENCENTCLOUD_SECRET_KEY")
...
cred = credential.Credential(secret_id, secret_key)

The skill reads Tencent Cloud API credentials from environment variables and uses them to authenticate OCR requests; this is expected for the service but gives the skill access to the user's Tencent Cloud account for this API call.

User impactAPI calls may use the user's Tencent Cloud account, permissions, quota, and billing resources.

RecommendationUse a least-privilege Tencent Cloud key, monitor OCR billing/quota, and avoid sharing broad cloud credentials with the runtime.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

scripts/main.py

http_profile.endpoint = "ocr.tencentcloudapi.com"
...
req.ImageUrl = args.image_url
...
req.ImageBase64 = load_image_base64(args.image_base64)
...
resp = client.LicensePlateOCR(req)

The skill sends the provided image URL or Base64 image data to Tencent Cloud's OCR API; license-plate images and OCR outputs can be sensitive even though this data flow is central to the skill's purpose.

User impactVehicle images, plate numbers, and related request metadata may be processed by Tencent Cloud.

RecommendationOnly submit images or URLs you are authorized to process, and review Tencent Cloud's OCR privacy, retention, and regional processing terms if the data is sensitive.