中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:1 day ago Rescan
15 /100
General Text Recognition OCR - 通用文字识别
图片通用文字 OCR，支持中英文及多语种，基于极速数据通用文字识别 API
A straightforward OCR skill that reads local images and POSTs them to a third-party JisuAPI endpoint. No malicious behavior found; the only concern is an example credential placeholder in docs that poses no actual risk.
Skill NameGeneral Text Recognition OCR - 通用文字识别
Duration41.3s
Enginepi
✓
Safe to install
The skill is safe to use. Consider explicitly documenting filesystem:READ in SKILL.md's metadata for completeness.

Findings 3 items

Severity Finding Location
Info
API key placeholder in documentation
SKILL.md:26 shows 'export JISU_API_KEY="your_appkey_here"' — a template placeholder example. This is a documentation string instructing users to replace it, not a real or leaked credential.
export JISU_API_KEY="your_appkey_here"
→ No action needed. Consider clarifying it is a placeholder (e.g., '# Replace with your actual key') to avoid false positives in automated scanners.
 SKILL.md:26
Low
Missing filesystem:READ declaration in metadata
The skill's metadata.requires does not list filesystem access, though the path parameter requires reading local files. This is a minor documentation gap rather than a security issue.
requires: { bins: ["python3"], env: ["JISU_API_KEY"] }
→ Add filesystem:READ to the metadata.requires if the skill manifest supports it, or document it in the SKILL.md description.
 SKILL.md:3
Info
Script path mismatch in documentation
SKILL.md references 'skills/generalrecognition/generalrecognition.py' but the actual file is at the repository root as 'generalrecognition.py'. This is a path inconsistency.
脚本文件：skills/generalrecognition/generalrecognition.py
→ Update the path to match the actual script location, or ensure the agent resolves the correct path at execution time.
 SKILL.md:32
ResourceDeclaredInferredStatusEvidence
Filesystem NONE READ ✓ Aligned generalrecognition.py:50 — open(path, 'rb') reads local image files for base64 e…
Network WRITE WRITE ✓ Aligned generalrecognition.py:83 — requests.post to https://api.jisuapi.com/generalrecog…
Shell NONE NONE — No subprocess, os.system, or shell invocation found
Environment READ READ ✓ Aligned generalrecognition.py:99 — os.getenv('JISU_API_KEY'), explicitly declared in met…
1 High 4 findings
🔑
High API Key 疑似硬编码凭证
API_KEY="your_appkey_here"
SKILL.md:26
🔗
Medium External URL 外部 URL
https://www.jisuapi.com/
SKILL.md:9
🔗
Medium External URL 外部 URL
https://www.jisuapi.com/api/generalrecognition/
SKILL.md:21
🔗
Medium External URL 外部 URL
https://api.jisuapi.com/generalrecognition/recognize
generalrecognition.py:17

File Tree

2 files · 10.4 KB · 314 lines
Python 1f · 164L Markdown 1f · 150L
├─ 🐍 generalrecognition.py Python 164L · 4.8 KB
└─ 📝 SKILL.md Markdown 150L · 5.6 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
requests * pip No No requirements.txt or package.json found; requests is imported but not pinned

Security Positives

✓ Path traversal protection: _normalize_local_path() blocks absolute paths and '..' sequences, preventing access outside the working directory
✓ No shell execution: script uses only standard library and requests, no subprocess or os.system
✓ No credential exfiltration: API key is read from env and sent only to the intended JisuAPI endpoint
✓ No hidden functionality: base64 encoding, file reading, and API call are all explicitly visible in code
✓ No suspicious patterns: no base64-piped-to-bash, no eval, no direct IP connections, no iteration over os.environ for secrets
✓ Clear error handling: all network, file, and JSON parsing errors are caught and reported cleanly