Skills
skills/malue-ai/dazee-small/multi-lang-ocr/Gen Agent Trust Hub

multi-lang-ocr

Fail

Audited by Gen Agent Trust Hub on Mar 6, 2026

Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill dynamically generates and executes a Swift script using the swift interpreter via subprocess.run to perform OCR on macOS.
  • [REMOTE_CODE_EXECUTION]: The Swift script is constructed using f-string interpolation of the image_path parameter without sanitization. An attacker can provide a file path containing double-quotes and Swift commands to execute arbitrary logic on the host machine.
  • [EXTERNAL_DOWNLOADS]: The skill instructs users or the agent to download and install the rapidocr-onnxruntime package from the public PyPI registry for cross-platform OCR support.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 6, 2026, 04:20 PM