📦

yescan-ocr-universal

Name: yescan-ocr-universal
Author: yescan-ai

v1.1.4 مراجعة المحتوى r1 مخاطر عالية 🌐 الوصول إلى الشبكة📁 الوصول إلى نظام الملفات🔑 متغيرات البيئة⚙️ الأوامر الخارجية⚡ يحتوي على سكربتات

استخراج النص من الصور باستخدام OCR

غالبا ما تحتوي الصور والمستندات الممسوحة ضوئيا على نص يصعب إعادة استخدامه. ترسل هذه المهارة صورة واحدة إلى خدمة OCR وتعيد نصا منظما لنوع المستند المطابق.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

توقف واطلب التأكيد قبل التثبيت.

راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "yescan-ocr-universal" from https://skillstore.io/skills/yescan-ai-yescan-ocr-universal.md and its manifest at https://skillstore.io/api/skills/yescan-ai-yescan-ocr-universal/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/yescan-ai-yescan-ocr-universal.md manifest موقَّع GET /api/skills/yescan-ai-yescan-ocr-universal/manifest lockfile موقَّع GET /api/skills/yescan-ai-yescan-ocr-universal/lockfile

اختبرها

جارٍ استخدام "yescan-ocr-universal". صورة لفاتورة VAT.

النتيجة المتوقعة:

يتم إرجاع نوع الفاتورة، ورقم الفاتورة، وتاريخ الإصدار، والبائع، والمشتري، ومبلغ الضريبة، والإجمالي كحقول منظمة.
يمكن نسخ النتيجة إلى سير عمل مراجعة مالية.

جارٍ استخدام "yescan-ocr-universal". لقطة شاشة تحتوي على جدول.

النتيجة المتوقعة:

يتم إرجاع الصفوف، والأعمدة، ونص الخلايا في بنية شبيهة بالجدول.
قد تحتاج الخلايا المدمجة أو غير الواضحة إلى مراجعة يدوية.

جارٍ استخدام "yescan-ocr-universal". صورة قائمة بلغة أجنبية للترجمة.

النتيجة المتوقعة:

يتم إرجاع النص المتعرف عليه والنص المترجم.
يتم حفظ صورة مترجمة محليا وإرجاع مسارها.

التدقيق الأمني

مخاطر عالية

v6 • ٩‏/٧‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

The skill is an OCR client that sends user images and SCAN_WEBSERVICE_KEY to the Quark Scan King service and can write translated images to /tmp/imgs. Confirmed risks include outbound sensitive document transfer, plaintext hidden API-key storage, temporary output files, and secret handling; most command execution, Windows Credential Manager, obfuscation, and high-entropy alerts are false positives from markdown or ordinary image/Base64 handling. No prompt injection attempt was found.

الملفات التي تم فحصها

2,951

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (4)

مرتفع

scripts/common/ocr_client.py:45

Environment file access

# 沙箱凭证兜底文件:HOME 根目录下的 .yescan_env,与其它 .env-aware 工具隔离

The code explicitly uses a home-directory .yescan_env file as credential fallback. This is a real environment-file secret access pattern.

مرتفع

SKILL.md:87-149 references/privacy.md:7-16

Sensitive Document Images Sent to Third-Party OCR Service

The skill explicitly supports IDs, social security cards, travel permits, degree certificates, tickets, invoices, medical reports, and other sensitive documents. The privacy documentation states user-provided images are sent to scan-business.quark.cn for OCR, so sensitive personal or regulated data leaves the user environment.

The supported scenes include multiple PII and medical document types, and the privacy table confirms image data is transmitted to a third-party OCR service.

متوسط

references/privacy.md:9-13 SECURITY.md:7-10 scripts/common/ocr_client.py:177-183

API Key Transport Documentation Mismatch

The privacy and security documents describe SCAN_WEBSERVICE_KEY as sent in an HTTP header. The implementation instead places the key in the JSON request body as aiApiKey, which weakens auditability and may mislead users reviewing exposure paths.

The documentation says the key is sent as a header, while the request builder clearly includes aiApiKey inside the JSON payload.

متوسط

scripts/common/validators.py:31-39 scripts/common/ocr_client.py:177-189

Arbitrary URL Forwarding Without Private Address Filtering

The URL validator accepts any http or https URL and does not block private, loopback, or metadata addresses before forwarding dataUrl to the OCR service. If the upstream service fetches supplied URLs, this can enable abuse of the provider as a URL fetcher.

The local validator only checks scheme and parseability, then the client forwards the URL as dataUrl. Impact depends on upstream fetch behavior, so confidence is high enough to retain but not maximal.

عناصر مراجعة القدرات (72)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

مرتفع

README.md:43

Hidden file in home directory

echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.md:44

Hidden file in home directory

chmod 600 ~/.yescan_env

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.md:46

Hidden file in home directory

> The environment variable takes priority; if not set, the key is loaded from `~/.yescan_env`.

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.md:91

Hidden file in home directory

- `SCAN_WEBSERVICE_KEY` environment variable (or `~/.yescan_env`)

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.md:43

Hidden file access

echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.md:44

Hidden file access

chmod 600 ~/.yescan_env

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.md:46

Hidden file access

> The environment variable takes priority; if not set, the key is loaded from `~/.yescan_env`.

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.md:91

Hidden file access

- `SCAN_WEBSERVICE_KEY` environment variable (or `~/.yescan_env`)

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.md:39

Generic API/secret keys

export SCAN_WEBSERVICE_KEY=<your_api_key>

The documentation requires SCAN_WEBSERVICE_KEY, which is an API credential used by the skill. Secret configuration is expected but remains a real secret-handling risk.

مرتفع

README.md:43

Generic API/secret keys

echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env

The documentation requires SCAN_WEBSERVICE_KEY, which is an API credential used by the skill. Secret configuration is expected but remains a real secret-handling risk.

مرتفع

README.zh-CN.md:43

Hidden file in home directory

echo 'SCAN_WEBSERVICE_KEY=<你的密钥>' > ~/.yescan_env

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.zh-CN.md:44

Hidden file in home directory

chmod 600 ~/.yescan_env

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.zh-CN.md:46

Hidden file in home directory

> 优先读取环境变量,未设置时自动从 `~/.yescan_env` 文件加载。

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.zh-CN.md:91

Hidden file in home directory

- 配置 `SCAN_WEBSERVICE_KEY` 环境变量(或 `~/.yescan_env`)

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.zh-CN.md:43

Hidden file access

echo 'SCAN_WEBSERVICE_KEY=<你的密钥>' > ~/.yescan_env

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.zh-CN.md:44

Hidden file access

chmod 600 ~/.yescan_env

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.zh-CN.md:46

Hidden file access

> 优先读取环境变量,未设置时自动从 `~/.yescan_env` 文件加载。

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

README.zh-CN.md:91

Hidden file access

- 配置 `SCAN_WEBSERVICE_KEY` 环境变量(或 `~/.yescan_env`)

The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.

مرتفع

references/privacy.md:26

Hidden file in home directory

### 3.1 推荐方式:写入 `~/.yescan_env`(永久生效)

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:28

Hidden file in home directory

技能每次执行会读取 `~/.yescan_env`,无需重启会话。

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:33

Hidden file in home directory

echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:34

Hidden file in home directory

chmod 600 ~/.yescan_env

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:55

Hidden file in home directory

3. 如怀疑密钥泄露:在同一后台立即 *轮换* 或 *撤销* 旧密钥,并更新 `~/.yescan_env`

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:59

Hidden file in home directory

- [x] `~/.yescan_env` 设为 `0600` 权限,避免同机其他用户读取

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:26

Hidden file access

### 3.1 推荐方式:写入 `~/.yescan_env`(永久生效)

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:28

Hidden file access

技能每次执行会读取 `~/.yescan_env`,无需重启会话。

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:33

Hidden file access

echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:34

Hidden file access

chmod 600 ~/.yescan_env

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:55

Hidden file access

3. 如怀疑密钥泄露:在同一后台立即 *轮换* 或 *撤销* 旧密钥,并更新 `~/.yescan_env`

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:59

Hidden file access

- [x] `~/.yescan_env` 设为 `0600` 权限,避免同机其他用户读取

The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.

مرتفع

references/privacy.md:33

Generic API/secret keys

echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env

The privacy document configures SCAN_WEBSERVICE_KEY as the service credential. Handling an API secret is expected for this skill but remains security-relevant.

مرتفع

references/privacy.md:40

Generic API/secret keys

'SCAN_WEBSERVICE_KEY=<your_api_key_here>' | Out-File -FilePath $HOME\.yescan_env -Encoding utf8

The privacy document configures SCAN_WEBSERVICE_KEY as the service credential. Handling an API secret is expected for this skill but remains security-relevant.

مرتفع

references/privacy.md:46

Generic API/secret keys

export SCAN_WEBSERVICE_KEY=<your_api_key_here>

The privacy document configures SCAN_WEBSERVICE_KEY as the service credential. Handling an API secret is expected for this skill but remains security-relevant.

مرتفع

references/troubleshooting.md:11

Hidden file in home directory

| A0100 | 凭证无效 | 1. 确认 `~/.yescan_env` 存在且包含 `SCAN_WEBSERVICE_KEY=<key>`<br>2. 确认 key 无前后空格或引号问题<br>

The troubleshooting guidance relies on ~/.yescan_env containing SCAN_WEBSERVICE_KEY. This confirms the skill ecosystem uses a plaintext hidden credential file.

مرتفع

references/troubleshooting.md:11

Hidden file access

| A0100 | 凭证无效 | 1. 确认 `~/.yescan_env` 存在且包含 `SCAN_WEBSERVICE_KEY=<key>`<br>2. 确认 key 无前后空格或引号问题<br>

The troubleshooting guidance relies on ~/.yescan_env containing SCAN_WEBSERVICE_KEY. This confirms the skill ecosystem uses a plaintext hidden credential file.

مرتفع

scripts/common/ocr_client.py:125

HTTP client library

response = self._send_request(param)

This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.

مرتفع

scripts/common/ocr_client.py:155

HTTP client library

response = self._send_request(param)

This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.

مرتفع

scripts/common/ocr_client.py:174

HTTP client library

response = self._send_request(param)

This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.

مرتفع

scripts/common/ocr_client.py:196

HTTP client library

def _send_request(self, param: Dict[str, Any]) -> requests.Response:

This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.

مرتفع

scripts/common/ocr_client.py:86

Python HTTP libraries

self.session = requests.Session()

This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.

مرتفع

scripts/common/ocr_client.py:196

Python HTTP libraries

def _send_request(self, param: Dict[str, Any]) -> requests.Response:

This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.

مرتفع

scripts/common/ocr_client.py:42

Hidden file in home directory

2. 用户 HOME 目录下的 ~/.yescan_env 文件(沙箱环境用,KEY=VALUE 文本格式)

The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.

مرتفع

scripts/common/ocr_client.py:60

Hidden file in home directory

"""从 ~/.yescan_env 读取 KEY=VALUE,缺失或异常返回空串"""

The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.

مرتفع

scripts/common/ocr_client.py:42

Hidden file access

2. 用户 HOME 目录下的 ~/.yescan_env 文件(沙箱环境用,KEY=VALUE 文本格式)

The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.

مرتفع

scripts/common/ocr_client.py:60

Hidden file access

"""从 ~/.yescan_env 读取 KEY=VALUE,缺失或异常返回空串"""

The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.

مرتفع

scripts/common/ocr_client.py:50

Python getenv function

api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/ocr_client.py:50

getenv function call

api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/ocr_client.py:50

Generic API/secret keys

api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/ocr_client.py:51

Generic API/secret keys

if api_key:

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/ocr_client.py:52

Generic API/secret keys

return api_key

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/ocr_client.py:53

Generic API/secret keys

api_key = CredentialManager._read_from_file("SCAN_WEBSERVICE_KEY")

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/ocr_client.py:54

Generic API/secret keys

if api_key:

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/ocr_client.py:55

Generic API/secret keys

return api_key

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/ocr_client.py:80

Generic API/secret keys

def __init__(self, api_key: str, scene: str, data_type: str, platform: str = None):

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/ocr_client.py:82

Generic API/secret keys

self.api_key = api_key

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/ocr_client.py:181

Generic API/secret keys

"aiApiKey": self.api_key,

The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.

مرتفع

scripts/common/runner.py:75

Generic API/secret keys

api_key = CredentialManager.load()

The runner loads SCAN_WEBSERVICE_KEY through CredentialManager before creating the OCR client. This is direct use of a service API secret.

مرتفع

scripts/common/runner.py:77

Generic API/secret keys

api_key=api_key,

The runner loads SCAN_WEBSERVICE_KEY through CredentialManager before creating the OCR client. This is direct use of a service API secret.

مرتفع

scripts/common/settings.py:18

Hardcoded URL

API_URL = "https://scan-business.quark.cn/vision"

API_URL is the hard-coded destination for all OCR requests. It confirms that user image data is sent to an external third-party service.

مرتفع

SECURITY.md:22

Hidden file in home directory

| API key stored in plaintext at `~/.yescan_env` | **disclosed**, standard practice | Recommend `chm

The security policy confirms the API key may be stored in plaintext at ~/.yescan_env. That is a real credential-at-rest risk even with chmod guidance.

مرتفع

SECURITY.md:22

Hidden file access

| API key stored in plaintext at `~/.yescan_env` | **disclosed**, standard practice | Recommend `chm

The security policy confirms the API key may be stored in plaintext at ~/.yescan_env. That is a real credential-at-rest risk even with chmod guidance.

مرتفع

SKILL.md:17

Hidden file in home directory

**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http

The skill instructions tell users to write SCAN_WEBSERVICE_KEY to ~/.yescan_env. This is a plaintext hidden home-directory credential file.

مرتفع

SKILL.md:17

Hidden file access

**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http

The skill instructions tell users to write SCAN_WEBSERVICE_KEY to ~/.yescan_env. This is a plaintext hidden home-directory credential file.

مرتفع

SKILL.md:17

Generic API/secret keys

**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http

The skill instructions require SCAN_WEBSERVICE_KEY as the API credential. Secret configuration is necessary but remains a real security concern.

متوسط

examples/pic-translate-example.md:24

Temp directory access

"translated_image_path": "/tmp/imgs/1728912345_a1b2c3d4e5f67890.png",

The example documents translated image output under /tmp/imgs, matching the implementation behavior. This can leave sensitive translated images in temporary storage until deleted.

متوسط

examples/pic-translate-example.md:32

Temp directory access

> 翻译完成,译图已保存:`/tmp/imgs/1728912345_a1b2c3d4e5f67890.png`,可直接打开查看。

The example documents translated image output under /tmp/imgs, matching the implementation behavior. This can leave sensitive translated images in temporary storage until deleted.

متوسط

references/privacy.md:22

Temp directory access

- **pic-translate 场景例外**:图片翻译场景会将译图保存到系统临时目录(`/tmp/imgs`),文件不会自动清理。

The privacy document discloses that pic-translate writes translated images to /tmp/imgs and does not automatically clean them up. Temporary storage can retain sensitive image content.

متوسط

scripts/common/file_saver.py:9

Temp file creation

import tempfile

The implementation uses tempfile.gettempdir as the default save root for generated output. This creates local artifacts in temporary storage that may contain sensitive translated images.

متوسط

scripts/common/file_saver.py:54

Temp file creation

DEFAULT_SAVE_DIR = tempfile.gettempdir()

The implementation uses tempfile.gettempdir as the default save root for generated output. This creates local artifacts in temporary storage that may contain sensitive translated images.

متوسط

scripts/common/file_saver.py:210

Python file write/append

with open(filepath, 'wb') as f:

The code writes Base64-decoded service output to disk. The path is generated by the saver, but the saved content can still contain sensitive user data and requires cleanup controls.

متوسط

SECURITY.md:12

Temp directory access

The security policy discloses translated images are written to /tmp/imgs. Local temporary image artifacts can retain sensitive content and need cleanup controls.

متوسط

SECURITY.md:44

Temp directory access

- Write output files to disk — except `pic-translate` scene, which saves the translated image to `/t

The security policy discloses translated images are written to /tmp/imgs. Local temporary image artifacts can retain sensitive content and need cleanup controls.

عوامل الخطر

🌐 الوصول إلى الشبكة (34)

examples/business-license-ocr-example.md:45 examples/commercial-invoice-ocr-example.md:47 examples/degree-certificate-ocr-example.md:46 examples/driver-license-ocr-example.md:45 examples/formula-ocr-example.md:40 examples/general-ocr-example.md:40 examples/handwritten-ocr-example.md:40 examples/idcard-ocr-example.md:45 examples/medical-report-ocr-example.md:45 examples/pharmaceutical-inspection-report-example.md:47 examples/pic-translate-example.md:41 examples/product-image-ocr-example.md:40 examples/question-ocr-example.md:40 examples/social-security-card-ocr-example.md:44 examples/table-ocr-example.md:49 examples/train-ticket-ocr-example.md:47 examples/travel-permit-ocr-example.md:44 examples/vat-invoice-ocr-example.md:47 examples/vehicle-license-ocr-example.md:45 references/implementation.md:14 scripts/common/messages.py:3 scripts/common/messages.py:4 scripts/common/ocr_client.py:125 scripts/common/ocr_client.py:155 scripts/common/ocr_client.py:174 scripts/common/ocr_client.py:196 scripts/common/ocr_client.py:86 scripts/common/ocr_client.py:196 scripts/common/ocr_client.py:212 scripts/common/runner.py:46 scripts/common/settings.py:18 SKILL.md:9 SKILL.md:17 SKILL.md:190

📁 الوصول إلى نظام الملفات (49)

🔑 متغيرات البيئة (21)

⚙️ الأوامر الخارجية (43)

⚡ يحتوي على سكربتات (1)

scripts/common/file_saver.py:15-18

دقّقه: codex عرض سجل التدقيق →

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/yescan-ai-yescan-ocr-universal/security.svg)](https://skillstore.io/skills/yescan-ai-yescan-ocr-universal?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/yescan-ai-yescan-ocr-universal?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/yescan-ai-yescan-ocr-universal/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/yescan-ai-yescan-ocr-universal.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

yescan-ai. (2026). yescan-ocr-universal security audit report (audit version 6) [Author version 1.1.4]. Skillstore. https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6

اقتباس BibTeX

@techreport{yescan-ai-yescan-ai-yescan-ocr-universal-2026,
  author = {yescan-ai},
  title = {yescan-ocr-universal security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6},
  note = {Author version 1.1.4}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "yescan-ocr-universal security audit report (audit version 6)"
version: "1.1.4"
type: report
authors:
  - name: "yescan-ai"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6"
identifiers:
  - type: other
    value: "skillstore:yescan-ai-yescan-ocr-universal:audit:6"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

100

قابلية الصيانة

المحتوى

المجتمع

100

الامتثال للمواصفات

ما الذي يمكنك بناؤه

رقمنة مستندات الأعمال

استخرج الحقول الأساسية من الفواتير، وتراخيص الأعمال، والتذاكر، والنماذج لتسريع إدخال السجلات.

معالجة أدلة المالية

اقرأ فواتير VAT، وتذاكر القطار، والفواتير التجارية قبل المراجعة الخاصة بالسداد أو التدقيق.

تحويل المواد الدراسية

تعرف على الصيغ، والأسئلة، والجداول، والملاحظات المكتوبة بخط اليد من صور الفصول الدراسية أو الأبحاث.

جرّب هذه الموجّهات

استخراج النص الأساسي

استخرج النص من هذه الصورة: /path/to/image.png

قراءة فاتورة

اقرأ صورة الفاتورة هذه وأعد البائع، والمشتري، والتاريخ، وبنود السطور، ومبلغ الضريبة، والإجمالي: /path/to/invoice.jpg

التعرف على جدول

استخرج الجدول من لقطة الشاشة هذه واحتفظ ببنية الصفوف والأعمدة: /path/to/table.png

التصنيف والاستخراج

حدد أفضل مشهد OCR لهذا المستند، واستخرج الحقول الأساسية، وحافظ على التسميات المهمة: /path/to/document.webp

أفضل الممارسات

تأكد من موافقة المستخدمين على معالجة OCR من جهة خارجية قبل إرسال الصور الحساسة.
استخدم متغيرات البيئة أو مخزن أسرار محميا لمفتاح API عندما يكون ذلك ممكنا.
احذف ملفات الصور المترجمة المؤقتة عندما لا تعود هناك حاجة إليها.

تجنب

لا تعالج بطاقات الهوية الحكومية، أو التقارير الطبية، أو السجلات المالية دون أساس امتثال واضح.
لا تمرر مسار دليل أو تطلب من المهارة فحص عدة ملفات في تشغيل واحد.
لا تلصق مفاتيح API في المطالبات، أو وسيطات الأوامر، أو لقطات الشاشة، أو السجلات المشتركة.