v1.0.2

TencentCloud RecognizeTable OCR

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 6:35 AM.

Analysis

This is a coherent Tencent Cloud table-OCR helper, but it requires Tencent API keys and sends the selected image/PDF to Tencent for processing.

GuidanceBefore installing, make sure you are comfortable sending selected table images/PDFs to Tencent Cloud, use a least-privileged Tencent Cloud OCR key, install the SDK from a trusted pinned version if possible, and choose any Excel output path carefully.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

SKILL.md

依赖：`tencentcloud-sdk-python`（通过 `pip install tencentcloud-sdk-python` 安装）

The skill depends on an external SDK installed via pip without a pinned version or lockfile in the artifacts. This is expected for the integration but leaves package provenance/version control to the user.

User impactInstalling an unpinned dependency can lead to different SDK versions being used over time.

RecommendationInstall the Tencent Cloud SDK from a trusted source, preferably in a virtual environment, and pin a known-good version for repeatable use.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

scripts/main.py

secret_id = os.environ.get("TENCENTCLOUD_SECRET_ID") ... secret_key = os.environ.get("TENCENTCLOUD_SECRET_KEY") ... cred = credential.Credential(secret_id, secret_key)

The script uses Tencent Cloud API credentials from environment variables. This is expected for a Tencent OCR integration, but it grants delegated cloud-account authority and is under-declared in registry metadata.

User impactOCR calls may be billed to the user's Tencent Cloud account, and the impact depends on how broadly the supplied key is permitted.

RecommendationUse a least-privileged Tencent Cloud CAM key limited to the needed OCR action, keep the environment variables private, and rotate the key if exposed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

scripts/main.py

http_profile.endpoint = "ocr.tencentcloudapi.com" ... req.ImageUrl = args.image_url ... req.ImageBase64 = load_image_base64(args.image_base64) ... resp = client.RecognizeTableAccurateOCR(req)

The selected image/PDF URL or Base64 file content is sent to Tencent Cloud's OCR API. This is purpose-aligned, but it is still an external provider data flow.

User impactPrivate or sensitive tables in images/PDFs may leave the local environment for cloud OCR processing.

RecommendationOnly process documents you are allowed to send to Tencent Cloud, and review Tencent Cloud's OCR data handling and retention terms for sensitive workloads.