Compétences yescan-ocr-universal
📦
yescan-ocr-universal
v1.1.4 Révision du contenu r1 Risque élevé 🌐 Accès réseau📁 Accès au système de fichiers🔑 Variables d’environnement⚙️ Commandes externes⚡ Contient des scripts
Extraire du texte à partir d’images avec l’OCR
Les images et les documents numérisés contiennent souvent du texte difficile à réutiliser. Cette compétence envoie une image à un service OCR et renvoie du texte structuré pour le type de document correspondant.
Prend en charge: Claude Codex Code(CC)
Arrêtez-vous et demandez confirmation avant l’installation.
Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.
Installer avec mon Agent
Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.
Demande d’agent
Review the Skillstore skill "yescan-ocr-universal" from https://skillstore.io/skills/yescan-ai-yescan-ocr-universal.md and its manifest at https://skillstore.io/api/skills/yescan-ai-yescan-ocr-universal/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.
Ressources lisibles par les agents
Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.
Tester
Utilisation de « yescan-ocr-universal ». Une photo d’une facture de TVA.
Résultat attendu:
- Le type de facture, le numéro de facture, la date d’émission, le vendeur, l’acheteur, le montant de la taxe et le total sont renvoyés sous forme de champs structurés.
- Le résultat peut être copié dans un flux de revue financière.
Utilisation de « yescan-ocr-universal ». Une capture d’écran contenant un tableau.
Résultat attendu:
- Les lignes, les colonnes et le texte des cellules sont renvoyés dans une structure de type tableau.
- Les cellules fusionnées ou peu claires peuvent nécessiter une revue manuelle.
Utilisation de « yescan-ocr-universal ». Une image de menu en langue étrangère à traduire.
Résultat attendu:
- Le texte reconnu et le texte traduit sont renvoyés.
- Une image traduite est enregistrée localement et son chemin est renvoyé.
Audit de sécurité
Risque élevév6 • 09/07/2026 Ouvrir le rapport versionné
The skill is an OCR client that sends user images and SCAN_WEBSERVICE_KEY to the Quark Scan King service and can write translated images to /tmp/imgs. Confirmed risks include outbound sensitive document transfer, plaintext hidden API-key storage, temporary output files, and secret handling; most command execution, Windows Credential Manager, obfuscation, and high-entropy alerts are false positives from markdown or ordinary image/Base64 handling. No prompt injection attempt was found.
38
Fichiers analysés
2,951
Lignes analysées
72
Éléments à examiner
0
Faux positifs ignorés
Préoccupations de sécurité confirmées (4)
Élevé
Environment file access
# 沙箱凭证兜底文件:HOME 根目录下的 .yescan_env,与其它 .env-aware 工具隔离
The code explicitly uses a home-directory .yescan_env file as credential fallback. This is a real environment-file secret access pattern.
Élevé
Sensitive Document Images Sent to Third-Party OCR Service
The skill explicitly supports IDs, social security cards, travel permits, degree certificates, tickets, invoices, medical reports, and other sensitive documents. The privacy documentation states user-provided images are sent to scan-business.quark.cn for OCR, so sensitive personal or regulated data leaves the user environment.
The supported scenes include multiple PII and medical document types, and the privacy table confirms image data is transmitted to a third-party OCR service.
Moyen
API Key Transport Documentation Mismatch
The privacy and security documents describe SCAN_WEBSERVICE_KEY as sent in an HTTP header. The implementation instead places the key in the JSON request body as aiApiKey, which weakens auditability and may mislead users reviewing exposure paths.
The documentation says the key is sent as a header, while the request builder clearly includes aiApiKey inside the JSON payload.
Moyen
Arbitrary URL Forwarding Without Private Address Filtering
The URL validator accepts any http or https URL and does not block private, loopback, or metadata addresses before forwarding dataUrl to the OCR service. If the upstream service fetches supplied URLs, this can enable abuse of the provider as a URL fetcher.
The local validator only checks scheme and parseability, then the client forwards the URL as dataUrl. Impact depends on upstream fetch behavior, so confidence is high enough to retain but not maximal.
Éléments d’évaluation des capacités (72)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
Élevé
Hidden file in home directory
echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file in home directory
chmod 600 ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file in home directory
> The environment variable takes priority; if not set, the key is loaded from `~/.yescan_env`.
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file in home directory
- `SCAN_WEBSERVICE_KEY` environment variable (or `~/.yescan_env`)
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file access
echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file access
chmod 600 ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file access
> The environment variable takes priority; if not set, the key is loaded from `~/.yescan_env`.
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file access
- `SCAN_WEBSERVICE_KEY` environment variable (or `~/.yescan_env`)
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Generic API/secret keys
export SCAN_WEBSERVICE_KEY=<your_api_key>
The documentation requires SCAN_WEBSERVICE_KEY, which is an API credential used by the skill. Secret configuration is expected but remains a real secret-handling risk.
Élevé
Generic API/secret keys
echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env
The documentation requires SCAN_WEBSERVICE_KEY, which is an API credential used by the skill. Secret configuration is expected but remains a real secret-handling risk.
Élevé
Hidden file in home directory
echo 'SCAN_WEBSERVICE_KEY=<你的密钥>' > ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file in home directory
chmod 600 ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file in home directory
> 优先读取环境变量,未设置时自动从 `~/.yescan_env` 文件加载。
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file in home directory
- 配置 `SCAN_WEBSERVICE_KEY` 环境变量(或 `~/.yescan_env`)
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file access
echo 'SCAN_WEBSERVICE_KEY=<你的密钥>' > ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file access
chmod 600 ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file access
> 优先读取环境变量,未设置时自动从 `~/.yescan_env` 文件加载。
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file access
- 配置 `SCAN_WEBSERVICE_KEY` 环境变量(或 `~/.yescan_env`)
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
Élevé
Hidden file in home directory
### 3.1 推荐方式:写入 `~/.yescan_env`(永久生效)
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file in home directory
技能每次执行会读取 `~/.yescan_env`,无需重启会话。
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file in home directory
echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file in home directory
chmod 600 ~/.yescan_env
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file in home directory
3. 如怀疑密钥泄露:在同一后台立即 *轮换* 或 *撤销* 旧密钥,并更新 `~/.yescan_env`
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file in home directory
- [x] `~/.yescan_env` 设为 `0600` 权限,避免同机其他用户读取
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file access
### 3.1 推荐方式:写入 `~/.yescan_env`(永久生效)
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file access
技能每次执行会读取 `~/.yescan_env`,无需重启会话。
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file access
echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file access
chmod 600 ~/.yescan_env
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file access
3. 如怀疑密钥泄露:在同一后台立即 *轮换* 或 *撤销* 旧密钥,并更新 `~/.yescan_env`
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Hidden file access
- [x] `~/.yescan_env` 设为 `0600` 权限,避免同机其他用户读取
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
Élevé
Generic API/secret keys
echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env
The privacy document configures SCAN_WEBSERVICE_KEY as the service credential. Handling an API secret is expected for this skill but remains security-relevant.
Élevé
Generic API/secret keys
'SCAN_WEBSERVICE_KEY=<your_api_key_here>' | Out-File -FilePath $HOME\.yescan_env -Encoding utf8
The privacy document configures SCAN_WEBSERVICE_KEY as the service credential. Handling an API secret is expected for this skill but remains security-relevant.
Élevé
Generic API/secret keys
export SCAN_WEBSERVICE_KEY=<your_api_key_here>
The privacy document configures SCAN_WEBSERVICE_KEY as the service credential. Handling an API secret is expected for this skill but remains security-relevant.
Élevé
Hidden file in home directory
| A0100 | 凭证无效 | 1. 确认 `~/.yescan_env` 存在且包含 `SCAN_WEBSERVICE_KEY=<key>`<br>2. 确认 key 无前后空格或引号问题<br>
The troubleshooting guidance relies on ~/.yescan_env containing SCAN_WEBSERVICE_KEY. This confirms the skill ecosystem uses a plaintext hidden credential file.
Élevé
Hidden file access
| A0100 | 凭证无效 | 1. 确认 `~/.yescan_env` 存在且包含 `SCAN_WEBSERVICE_KEY=<key>`<br>2. 确认 key 无前后空格或引号问题<br>
The troubleshooting guidance relies on ~/.yescan_env containing SCAN_WEBSERVICE_KEY. This confirms the skill ecosystem uses a plaintext hidden credential file.
Élevé
HTTP client library
response = self._send_request(param)
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
Élevé
HTTP client library
response = self._send_request(param)
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
Élevé
HTTP client library
response = self._send_request(param)
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
Élevé
HTTP client library
def _send_request(self, param: Dict[str, Any]) -> requests.Response:
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
Élevé
Python HTTP libraries
self.session = requests.Session()
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
Élevé
Python HTTP libraries
def _send_request(self, param: Dict[str, Any]) -> requests.Response:
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
Élevé
Hidden file in home directory
2. 用户 HOME 目录下的 ~/.yescan_env 文件(沙箱环境用,KEY=VALUE 文本格式)
The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.
Élevé
Hidden file in home directory
"""从 ~/.yescan_env 读取 KEY=VALUE,缺失或异常返回空串"""
The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.
Élevé
Hidden file access
2. 用户 HOME 目录下的 ~/.yescan_env 文件(沙箱环境用,KEY=VALUE 文本格式)
The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.
Élevé
Hidden file access
"""从 ~/.yescan_env 读取 KEY=VALUE,缺失或异常返回空串"""
The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.
Élevé
Python getenv function
api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
getenv function call
api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
Generic API/secret keys
api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
Generic API/secret keys
if api_key:
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
Generic API/secret keys
return api_key
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
Generic API/secret keys
api_key = CredentialManager._read_from_file("SCAN_WEBSERVICE_KEY")
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
Generic API/secret keys
if api_key:
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
Generic API/secret keys
return api_key
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
Generic API/secret keys
def __init__(self, api_key: str, scene: str, data_type: str, platform: str = None):
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
Generic API/secret keys
self.api_key = api_key
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
Generic API/secret keys
"aiApiKey": self.api_key,
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
Élevé
Generic API/secret keys
api_key = CredentialManager.load()
The runner loads SCAN_WEBSERVICE_KEY through CredentialManager before creating the OCR client. This is direct use of a service API secret.
Élevé
Generic API/secret keys
api_key=api_key,
The runner loads SCAN_WEBSERVICE_KEY through CredentialManager before creating the OCR client. This is direct use of a service API secret.
Élevé
Hardcoded URL
API_URL = "https://scan-business.quark.cn/vision"
API_URL is the hard-coded destination for all OCR requests. It confirms that user image data is sent to an external third-party service.
Élevé
Hidden file in home directory
| API key stored in plaintext at `~/.yescan_env` | **disclosed**, standard practice | Recommend `chm
The security policy confirms the API key may be stored in plaintext at ~/.yescan_env. That is a real credential-at-rest risk even with chmod guidance.
Élevé
Hidden file access
| API key stored in plaintext at `~/.yescan_env` | **disclosed**, standard practice | Recommend `chm
The security policy confirms the API key may be stored in plaintext at ~/.yescan_env. That is a real credential-at-rest risk even with chmod guidance.
Élevé
Hidden file in home directory
**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http
The skill instructions tell users to write SCAN_WEBSERVICE_KEY to ~/.yescan_env. This is a plaintext hidden home-directory credential file.
Élevé
Hidden file access
**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http
The skill instructions tell users to write SCAN_WEBSERVICE_KEY to ~/.yescan_env. This is a plaintext hidden home-directory credential file.
Élevé
Generic API/secret keys
**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http
The skill instructions require SCAN_WEBSERVICE_KEY as the API credential. Secret configuration is necessary but remains a real security concern.
Moyen
Temp directory access
"translated_image_path": "/tmp/imgs/1728912345_a1b2c3d4e5f67890.png",
The example documents translated image output under /tmp/imgs, matching the implementation behavior. This can leave sensitive translated images in temporary storage until deleted.
Moyen
Temp directory access
> 翻译完成,译图已保存:`/tmp/imgs/1728912345_a1b2c3d4e5f67890.png`,可直接打开查看。
The example documents translated image output under /tmp/imgs, matching the implementation behavior. This can leave sensitive translated images in temporary storage until deleted.
Moyen
Temp directory access
- **pic-translate 场景例外**:图片翻译场景会将译图保存到系统临时目录(`/tmp/imgs`),文件不会自动清理。
The privacy document discloses that pic-translate writes translated images to /tmp/imgs and does not automatically clean them up. Temporary storage can retain sensitive image content.
Moyen
Temp file creation
import tempfile
The implementation uses tempfile.gettempdir as the default save root for generated output. This creates local artifacts in temporary storage that may contain sensitive translated images.
Moyen
Temp file creation
DEFAULT_SAVE_DIR = tempfile.gettempdir()
The implementation uses tempfile.gettempdir as the default save root for generated output. This creates local artifacts in temporary storage that may contain sensitive translated images.
Moyen
Python file write/append
with open(filepath, 'wb') as f:
The code writes Base64-decoded service output to disk. The path is generated by the saver, but the saved content can still contain sensitive user data and requires cleanup controls.
Moyen
Temp directory access
| Translated image (`pic-translate` only) | **local write** | `/tmp/imgs/` | depends on content |
The security policy discloses translated images are written to /tmp/imgs. Local temporary image artifacts can retain sensitive content and need cleanup controls.
Moyen
Temp directory access
- Write output files to disk — except `pic-translate` scene, which saves the translated image to `/t
The security policy discloses translated images are written to /tmp/imgs. Local temporary image artifacts can retain sensitive content and need cleanup controls.
Facteurs de risque
🌐 Accès réseau (34)
examples/business-license-ocr-example.md:45 examples/commercial-invoice-ocr-example.md:47 examples/degree-certificate-ocr-example.md:46 examples/driver-license-ocr-example.md:45 examples/formula-ocr-example.md:40 examples/general-ocr-example.md:40 examples/handwritten-ocr-example.md:40 examples/idcard-ocr-example.md:45 examples/medical-report-ocr-example.md:45 examples/pharmaceutical-inspection-report-example.md:47 examples/pic-translate-example.md:41 examples/product-image-ocr-example.md:40 examples/question-ocr-example.md:40 examples/social-security-card-ocr-example.md:44 examples/table-ocr-example.md:49 examples/train-ticket-ocr-example.md:47 examples/travel-permit-ocr-example.md:44 examples/vat-invoice-ocr-example.md:47 examples/vehicle-license-ocr-example.md:45 references/implementation.md:14 scripts/common/messages.py:3 scripts/common/messages.py:4 scripts/common/ocr_client.py:125 scripts/common/ocr_client.py:155 scripts/common/ocr_client.py:174 scripts/common/ocr_client.py:196 scripts/common/ocr_client.py:86 scripts/common/ocr_client.py:196 scripts/common/ocr_client.py:212 scripts/common/runner.py:46 scripts/common/settings.py:18 SKILL.md:9 SKILL.md:17 SKILL.md:190
📁 Accès au système de fichiers (49)
examples/pic-translate-example.md:24 examples/pic-translate-example.md:32 README.md:43 README.md:44 README.md:46 README.md:91 README.md:43 README.md:44 README.md:46 README.md:91 README.zh-CN.md:43 README.zh-CN.md:44 README.zh-CN.md:46 README.zh-CN.md:91 README.zh-CN.md:43 README.zh-CN.md:44 README.zh-CN.md:46 README.zh-CN.md:91 references/privacy.md:26 references/privacy.md:28 references/privacy.md:33 references/privacy.md:34 references/privacy.md:55 references/privacy.md:59 references/privacy.md:26 references/privacy.md:28 references/privacy.md:33 references/privacy.md:34 references/privacy.md:55 references/privacy.md:59 references/privacy.md:22 references/troubleshooting.md:11 references/troubleshooting.md:11 scripts/common/__init__.py:7 scripts/common/file_saver.py:9 scripts/common/file_saver.py:54 scripts/common/file_saver.py:210 scripts/common/ocr_client.py:42 scripts/common/ocr_client.py:60 scripts/common/ocr_client.py:42 scripts/common/ocr_client.py:60 scripts/common/settings.py:11 scripts/common/settings.py:12 SECURITY.md:22 SECURITY.md:22 SECURITY.md:12 SECURITY.md:44 SKILL.md:17 SKILL.md:17
🔑 Variables d’environnement (21)
README.md:39 README.md:43 references/privacy.md:33 references/privacy.md:40 references/privacy.md:46 scripts/common/ocr_client.py:50 scripts/common/ocr_client.py:50 scripts/common/ocr_client.py:50 scripts/common/ocr_client.py:51 scripts/common/ocr_client.py:52 scripts/common/ocr_client.py:53 scripts/common/ocr_client.py:54 scripts/common/ocr_client.py:55 scripts/common/ocr_client.py:80 scripts/common/ocr_client.py:82 scripts/common/ocr_client.py:181 scripts/common/result_handlers.py:48 scripts/common/result_handlers.py:84 scripts/common/runner.py:75 scripts/common/runner.py:77 SKILL.md:17
⚙️ Commandes externes (43)
references/privacy.md:37 references/privacy.md:39 scripts/common/settings.py:7 scripts/common/settings.py:11 scripts/common/settings.py:12 scripts/common/settings.py:13 SKILL.md:15 SKILL.md:17 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:41-43 SKILL.md:43-52 SKILL.md:52-61 SKILL.md:61-63 SKILL.md:63 SKILL.md:64 SKILL.md:65-73 SKILL.md:73 SKILL.md:79-84 SKILL.md:84-89 SKILL.md:89-94 SKILL.md:94-99 SKILL.md:99-104 SKILL.md:104-109 SKILL.md:109-114 SKILL.md:114-119 SKILL.md:119-124 SKILL.md:124-129 SKILL.md:129-134 SKILL.md:134-139 SKILL.md:139-144 SKILL.md:144-149 SKILL.md:149-154 SKILL.md:154-159 SKILL.md:159-164 SKILL.md:164-169 SKILL.md:169-185 SKILL.md:185-198 SKILL.md:198-199 SKILL.md:199-200 SKILL.md:200-201 SKILL.md:201-202
⚡ Contient des scripts (1)
Audité par: codex Voir l’historique des audits →
Partager et citer ce rapport
Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.
Copier le lien du rapport
https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/yescan-ai-yescan-ocr-universal?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/yescan-ai-yescan-ocr-universal?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/yescan-ai-yescan-ocr-universal/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Carte intégrable
<iframe src="https://skillstore.io/embed/skills/yescan-ai-yescan-ocr-universal.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citations académiques (APA · BibTeX · CFF)
Citation APA
yescan-ai. (2026). yescan-ocr-universal security audit report (audit version 6) [Author version 1.1.4]. Skillstore. https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6Citation BibTeX
@techreport{yescan-ai-yescan-ai-yescan-ocr-universal-2026,
author = {yescan-ai},
title = {yescan-ocr-universal security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6},
note = {Author version 1.1.4}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "yescan-ocr-universal security audit report (audit version 6)"
version: "1.1.4"
type: report
authors:
- name: "yescan-ai"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6"
identifiers:
- type: other
value: "skillstore:yescan-ai-yescan-ocr-universal:audit:6"
description: "Skillstore immutable audit report identifier"
Score Skillstore
Pourquoi ce score Niveau de confiance des preuves: Moyen 82
Architecture
100
Maintenabilité
87
Contenu
71
Communauté
100
Conformité aux spécifications
Ce que vous pouvez créer
Numériser des documents professionnels
Extraire les champs clés de factures, licences commerciales, billets et formulaires afin d’accélérer la saisie des dossiers.
Traiter les justificatifs financiers
Lire les factures de TVA, les billets de train et les factures commerciales avant un remboursement ou une revue d’audit.
Convertir des supports d’étude
Reconnaître les formules, questions, tableaux et notes manuscrites à partir d’images de cours ou de recherche.
Essayez ces prompts
Extraire du texte de base
Extrais le texte de cette image : /path/to/image.png
Lire une facture
Lis cette image de facture et renvoie le vendeur, l’acheteur, la date, les lignes d’articles, le montant de la taxe et le total : /path/to/invoice.jpg
Reconnaître un tableau
Extrais le tableau de cette capture d’écran et conserve la structure des lignes et des colonnes : /path/to/table.png
Classer et extraire
Identifie la meilleure scène OCR pour ce document, extrais les champs clés et préserve les libellés importants : /path/to/document.webp
Bonnes pratiques
- Confirmer que les utilisateurs approuvent le traitement OCR par un tiers avant d’envoyer des images sensibles.
- Utiliser des variables d’environnement ou un coffre-fort de secrets protégé pour la clé API lorsque c’est possible.
- Supprimer les fichiers image traduits temporaires lorsqu’ils ne sont plus nécessaires.
Éviter
- Ne pas traiter de pièces d’identité gouvernementales, de rapports médicaux ou de documents financiers sans base de conformité claire.
- Ne pas transmettre un chemin de répertoire ni demander à la compétence d’analyser de nombreux fichiers en une seule exécution.
- Ne pas coller de clés API dans les prompts, les arguments de commande, les captures d’écran ou les journaux partagés.
Foire aux questions
Cette compétence fonctionne-t-elle sans clé API ?
Non. Elle nécessite SCAN_WEBSERVICE_KEY pour le service Quark Scan King.
Peut-elle traiter des fichiers image locaux ?
Oui. Elle peut lire un chemin d’image local spécifié par l’utilisateur et envoyer le contenu de l’image pour l’OCR.
Où les données d’image sont-elles envoyées ?
La compétence envoie l’entrée d’image à scan-business.quark.cn pour le traitement OCR.
Prend-elle en charge les tableaux numérisés ?
Oui. Utilisez la scène OCR de tableau lorsque l’image contient un tableau qui doit conserver la structure des lignes et des colonnes.
Peut-elle traduire le texte à l’intérieur d’une image ?
Oui. La scène pic-translate renvoie le texte traduit et enregistre une image traduite localement.
Gère-t-elle plusieurs images à la fois ?
Non. Le flux de travail documenté traite une image par invocation.
Détails du développeur
Auteur
yescan-aiLicence
MIT
Version de l’auteur
v1.1.4
Révision Skillstore
r1
Réf
26421118b848d9f1efc0aa169d8a7a9e7e0a877e
Récence de maintenance
20/07/2026
Utilisation
29 téléchargements · 0 vues
Structure de fichiers
📄 business-license-ocr-example.md
📄 commercial-invoice-ocr-example.md
📄 degree-certificate-ocr-example.md
📄 driver-license-ocr-example.md
📄 medical-report-ocr-example.md
📄 pharmaceutical-inspection-report-example.md
📄 product-image-ocr-example.md
📄 social-security-card-ocr-example.md
📄 travel-permit-ocr-example.md
📄 vehicle-license-ocr-example.md
📁 scripts/
📁 common/
📄 scan.py
📄 LICENSE
📄 SKILL.md