Habilidades yescan-universal

📦

yescan-universal

Name: yescan-universal
Author: yescan-ai

v1.0.5 Revisión del contenido r1 Riesgo alto 🔑 Variables de entorno🌐 Acceso a red📁 Acceso al sistema de archivos⚙️ Comandos externos

Procesar imágenes con Quark Scan OCR

Los flujos de trabajo con muchas imágenes a menudo necesitan OCR, limpieza, traducción y conversión de documentos en muchos formatos. Esta skill enruta imágenes proporcionadas por el usuario a través de la CLI de yescan y el servicio Quark Scan con pasos explícitos de configuración y verificación.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "yescan-universal" from https://skillstore.io/skills/yescan-ai-yescan-universal.md and its manifest at https://skillstore.io/api/skills/yescan-ai-yescan-universal/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/yescan-ai-yescan-universal.md Manifest firmado GET /api/skills/yescan-ai-yescan-universal/manifest Lockfile firmado GET /api/skills/yescan-ai-yescan-universal/lockfile

Pruébalo

Usando "yescan-universal". Un usuario proporciona una foto de un recibo y solicita OCR.

Resultado esperado:

El asistente comprueba la configuración de yescan, selecciona la escena de OCR correspondiente, ejecuta el comando y devuelve el texto extraído del recibo.

Usando "yescan-universal". Un usuario proporciona un formulario escaneado borroso y solicita limpieza.

Resultado esperado:

El asistente selecciona una escena de mejora, procesa la imagen, verifica el éxito y proporciona la ruta local del archivo de salida.

Usando "yescan-universal". Un usuario proporciona una imagen de una hoja de cálculo y solicita conversión a Excel.

Resultado esperado:

El asistente descubre la escena de conversión, la ejecuta en la imagen e informa la ruta de la hoja de cálculo generada.

Auditoría de seguridad

Riesgo alto

v3 • 8/7/2026 Abrir el informe versionado

The reviewed files are readable documentation and skill instructions, not obfuscated payloads. The main confirmed risks are third-party image upload, API key handling, hidden credential storage, temp-file outputs, and yescan or pip command execution. I found no evidence of prompt injection, hidden endpoints, or attempts to bypass the audit.

Archivos escaneados

488

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Alto

references/privacy.md:11-12 references/implementation.md:14 SECURITY.md:9-10

Third-Party Image and Credential Transmission

The skill sends user-provided images and SCAN_WEBSERVICE_KEY to Quark Scan services. Images may contain personal, financial, or regulated information.

The privacy and implementation documents explicitly state that user images and the API key leave the machine for Quark Scan processing.

Elementos de revisión de capacidades (35)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

README.en.md:25

Generic API/secret keys

yescan config set SCAN_WEBSERVICE_KEY <your_api_key>

The line instructs users to configure or export SCAN_WEBSERVICE_KEY, a real service credential. It is a legitimate setup step, but mishandling the key can expose account access.

Alto

README.md:25

Generic API/secret keys

yescan config set SCAN_WEBSERVICE_KEY <your_api_key>

The line instructs users to configure or export SCAN_WEBSERVICE_KEY, a real service credential. It is a legitimate setup step, but mishandling the key can expose account access.

Alto

references/privacy.md:34

Hidden file in home directory

配置保存在 `~/.yescan/config.json`。

The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.

Alto

references/privacy.md:42

Hidden file in home directory

> 优先级:CLI config(`~/.yescan/config.json`)> 环境变量

The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.

Alto

references/privacy.md:31

Generic API/secret keys

yescan config set SCAN_WEBSERVICE_KEY <your_api_key_here>

The line instructs users to configure or export SCAN_WEBSERVICE_KEY, a real service credential. It is a legitimate setup step, but mishandling the key can expose account access.

Alto

references/privacy.md:39

Generic API/secret keys

export SCAN_WEBSERVICE_KEY=<your_api_key_here>

The line instructs users to configure or export SCAN_WEBSERVICE_KEY, a real service credential. It is a legitimate setup step, but mishandling the key can expose account access.

Alto

SECURITY.md:21

Hidden file in home directory

| API key stored via `yescan config` (`~/.yescan/config.json`) | **disclosed**, standard practice |

The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.

Alto

SKILL.md:23

Generic API/secret keys

- 设置命令:`yescan config set SCAN_WEBSERVICE_KEY <your_api_key>`

The line instructs users to configure or export SCAN_WEBSERVICE_KEY, a real service credential. It is a legitimate setup step, but mishandling the key can expose account access.

Medio

references/implementation.md:14

Hardcoded URL

→ POST https://scan-business.quark.cn/vision

The implementation documents a POST to https://scan-business.quark.cn/vision. This is a real external service call that can transmit user images and credentials.

Medio

references/implementation.md:45

Temp directory access

"path": "/tmp/imgs/<Unix时间戳>_<16位随机十六进制串>.<扩展名>"

The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.

Medio

references/implementation.md:65

Temp directory access

| 图像增强 | 图片落盘 | 系统临时目录下的 `imgs/` 子目录(如 `/tmp/imgs/`)或 `--output` 目录 |

The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.

Medio

references/implementation.md:66

Temp directory access

| 文档转换 | 文档落盘 | 系统临时目录下的 `documents/` 子目录(如 `/tmp/documents/`)或 `--output` 目录 |

The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.

Medio

references/implementation.md:67

Temp directory access

| AIGC 生成 | 图片落盘 | 系统临时目录下的 `imgs/` 子目录(如 `/tmp/imgs/`)或 `--output` 目录 |

The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.

Medio

references/privacy.md:34

Hidden file access

配置保存在 `~/.yescan/config.json`。

The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.

Medio

references/privacy.md:42

Hidden file access

> 优先级:CLI config(`~/.yescan/config.json`)> 环境变量

The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.

Medio

references/privacy.md:21

Temp directory access

- **图像增强场景**:输出增强后图片到系统临时目录下的 `imgs/` 子目录(如 `/tmp/imgs/`)或 `--output` 指定目录

The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.

Medio

references/privacy.md:22

Temp directory access

- **文档转换场景**:输出文档文件到系统临时目录下的 `documents/` 子目录(如 `/tmp/documents/`)或 `--output` 指定目录

The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.

Medio

references/privacy.md:23

Temp directory access

- **AIGC 场景**:输出生成图片到系统临时目录下的 `imgs/` 子目录(如 `/tmp/imgs/`)或 `--output` 指定目录

The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.

Medio

SECURITY.md:21

Hidden file access

| API key stored via `yescan config` (`~/.yescan/config.json`) | **disclosed**, standard practice |

The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.

Medio

SECURITY.md:22

Temp directory access

| Output files written to system temp dir's `imgs/` and `documents/` subdirs (e.g. `/tmp/imgs/`, `/t

The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.

Medio

SKILL.md:20

Ruby/shell backtick execution

1. `yescan --version` — 未安装则执行 `pip3 install yescan`;若版本 < 1.0.5,执行 `pip3 install yescan --upgrade`,

The skill instructs agents to run yescan --version and pip3 install or upgrade yescan. Installing or upgrading packages at runtime is real command execution and supply-chain exposure.

Medio

SKILL.md:21

Ruby/shell backtick execution

2. `pip3 index versions yescan` — 若 INSTALLED < LATEST,告知用户有新版本可用并提供升级命令:`pip3 install yescan --upgr

The skill instructs agents to run pip3 index versions yescan and provide an upgrade command. This is real external command usage tied to package management.

Medio

SKILL.md:22

Ruby/shell backtick execution

- **密钥检查**:`yescan config get SCAN_WEBSERVICE_KEY`,未配置则引导用户配置

The skill instructs agents to run yescan config get SCAN_WEBSERVICE_KEY. This executes the CLI and reads credential configuration state.

Medio

SKILL.md:23

Ruby/shell backtick execution

- 设置命令:`yescan config set SCAN_WEBSERVICE_KEY <your_api_key>`

The skill provides a yescan config set command for an API key. This is real CLI execution involving secret material.

Medio

SKILL.md:29-32

Ruby/shell backtick execution

```bash

The code block instructs agents to run yescan scene-discovery commands. These are intended external CLI calls, even though they are part of normal operation.

Medio

SKILL.md:32-38

Ruby/shell backtick execution

```

The surrounding gate requires CLI output before proceeding. This reinforces mandatory external command execution during skill use.

Medio

SKILL.md:38-40

Ruby/shell backtick execution

1. 未执行 `yescan --version` 确认安装状态 → 禁止继续

The gate requires yescan --version before continuing. This is an explicit external command prerequisite.

Medio

SKILL.md:40-41

Ruby/shell backtick execution

3. 未执行 `pip3 index versions yescan` 确认最新版本状态 → 禁止继续

The gate requires pip3 index versions yescan before continuing. This is an explicit package-management command prerequisite.

Medio

SKILL.md:41-44

Ruby/shell backtick execution

4. 未执行 `yescan config get SCAN_WEBSERVICE_KEY` 确认密钥已配置 → 禁止继续

The gate requires yescan config get SCAN_WEBSERVICE_KEY before continuing. This reads secret configuration state through an external CLI.

Medio

SKILL.md:45-46

Ruby/shell backtick execution

- 未执行过 `--list-scenes` 则不得进入 Execute

The gate requires --list-scenes before execution. That is a real yescan CLI command used to choose later actions.

Medio

SKILL.md:50-53

Ruby/shell backtick execution

```bash

The execute block gives yescan commands that process user-provided paths or URLs. This is the main external command surface of the skill.

Medio

SKILL.md:53-54

Ruby/shell backtick execution

```

The surrounding execute section describes yescan command arguments for local paths and URLs. It is part of the command execution workflow.

Medio

SKILL.md:54

Ruby/shell backtick execution

> `--path` 传本地文件路径,`--url` 传 http/https 链接。

The line defines --path and --url inputs to the yescan CLI. User-provided files or URLs become command arguments and need validation.

Medio

SKILL.md:59

Ruby/shell backtick execution

- 多步处理为逐步 Execute → Verify 循环:step N+1 的命令在 step N Verify 通过后才构造,`--path` 取自 step N 响应中的 `data.path`

The workflow builds later commands from earlier data.path outputs. Chained command construction is real and should guard against unsafe paths.

Medio

SKILL.md:81-88

Ruby/shell backtick execution

- 根据错误信息自行修复(如场景名无效 → 重新 `--list-scenes`)或将错误原因告知用户

The troubleshooting gate can rerun --list-scenes after errors. It remains a real external CLI invocation, though within a recovery path.

Factores de riesgo

🔑 Variables de entorno (5)

README.en.md:25 README.md:25 references/privacy.md:31 references/privacy.md:39 SKILL.md:23

🌐 Acceso a red (3)

references/implementation.md:14 SKILL.md:9 SKILL.md:24

📁 Acceso al sistema de archivos (14)

references/implementation.md:45 references/implementation.md:65 references/implementation.md:66 references/implementation.md:67 references/privacy.md:34 references/privacy.md:42 references/privacy.md:34 references/privacy.md:42 references/privacy.md:21 references/privacy.md:22 references/privacy.md:23 SECURITY.md:21 SECURITY.md:21 SECURITY.md:22

⚙️ Comandos externos (23)

Auditado por: codex Ver historial de auditorías →

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/yescan-ai-yescan-universal/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/yescan-ai-yescan-universal/security.svg)](https://skillstore.io/skills/yescan-ai-yescan-universal?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/yescan-ai-yescan-universal?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/yescan-ai-yescan-universal/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/yescan-ai-yescan-universal.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

yescan-ai. (2026). yescan-universal security audit report (audit version 3) [Author version 1.0.5]. Skillstore. https://skillstore.io/skills/yescan-ai-yescan-universal/audits/3

Cita BibTeX

@techreport{yescan-ai-yescan-ai-yescan-universal-2026,
  author = {yescan-ai},
  title = {yescan-universal security audit report (audit version 3)},
  institution = {Skillstore},
  year = {2026},
  number = {3},
  url = {https://skillstore.io/skills/yescan-ai-yescan-universal/audits/3},
  note = {Author version 1.0.5}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "yescan-universal security audit report (audit version 3)"
version: "1.0.5"
type: report
authors:
  - name: "yescan-ai"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/yescan-ai-yescan-universal/audits/3"
identifiers:
  - type: other
    value: "skillstore:yescan-ai-yescan-universal:audit:3"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

100

Cumplimiento de la especificación

Lo que puedes crear

Extraer texto de imágenes empresariales

Convierte fotos de facturas, documentos de identidad, formularios, notas manuscritas o tablas en texto legible o salida estructurada.

Preparar imágenes de documentos más limpias

Mejora imágenes escaneadas eliminando marcas, sombras, escritura a mano o distorsión antes de compartirlas o archivarlas.

Convertir documentos basados en imágenes

Crea archivos Word, Excel o PDF a partir de entradas de imagen cuando la escena de yescan admite el formato de destino.

Prueba estos prompts

Ejecutar OCR básico

Extrae el texto de esta imagen con yescan. Muéstrame el contenido reconocido y menciona cualquier parte incierta.

Limpiar una imagen

Usa yescan para mejorar esta imagen escaneada. Elige la mejor escena de mejora disponible y luego devuelve la ruta del archivo de salida.

Convertir una foto de una tabla

Convierte esta foto de una tabla en un documento Excel con yescan. Verifica el resultado del comando antes de darme la ruta del archivo.

Crear una canalización de varios pasos

Primero mejora esta imagen de documento de baja calidad con yescan y luego ejecuta OCR en la salida mejorada. Detente si falla algún paso.

Mejores prácticas

Confirma que el usuario entiende que el contenido de la imagen se enviará a Quark Scan antes de procesar archivos sensibles.
Usa la lista de escenas de la sesión actual de la CLI en lugar de asumir nombres de escenas o parámetros.
Limpia los directorios de salida temporales después de procesar imágenes confidenciales o reguladas.

Evitar

No proceses archivos ni URLs que el usuario no haya proporcionado explícitamente en la solicitud actual.
No inventes nombres de escenas de yescan, campos de respuesta ni resultados de comandos.
No pegues claves de API en registros públicos, capturas de pantalla, ejemplos o transcripciones compartidas.