Compétences yescan-transoffice-universal
📦
yescan-transoffice-universal
v1.1.4 Révision du contenu r1 Risque élevé 🌐 Accès réseau📁 Accès au système de fichiers🔑 Variables d’environnement⚙️ Commandes externes
Convertir des scans en fichiers Office
Les images numérisées nécessitent souvent une ressaisie manuelle avant que les utilisateurs puissent les modifier. Cette skill convertit une image en fichier Word, Excel ou PDF via Quark Scan King.
Prend en charge: Claude Codex Code(CC)
Arrêtez-vous et demandez confirmation avant l’installation.
Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.
Installer avec mon Agent
Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.
Demande d’agent
Review the Skillstore skill "yescan-transoffice-universal" from https://skillstore.io/skills/yescan-ai-yescan-transoffice-universal.md and its manifest at https://skillstore.io/api/skills/yescan-ai-yescan-transoffice-universal/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.
Ressources lisibles par les agents
Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.
Tester
Utilisation de « yescan-transoffice-universal ». Un utilisateur fournit une photo locale d'un ordre du jour de réunion imprimé et demande une sortie Word.
Résultat attendu:
La skill renvoie un message de réussite avec un chemin de document local se terminant par .docx.
Utilisation de « yescan-transoffice-universal ». Un utilisateur fournit une capture d'écran d'un tableau financier et demande une sortie Excel.
Résultat attendu:
La skill enregistre un fichier .xlsx dans le répertoire temporaire et renvoie son chemin.
Utilisation de « yescan-transoffice-universal ». Un utilisateur fournit une URL d'image et demande une copie PDF.
Résultat attendu:
La skill envoie l'URL de l'image pour conversion et renvoie le chemin du PDF enregistré.
Audit de sécurité
Risque élevév7 • 08/07/2026 Ouvrir le rapport versionné
Review confirmed expected but material risks: the skill uploads user images or file-derived base64 plus SCAN_WEBSERVICE_KEY to a hard-coded Quark endpoint, then saves returned documents under the system temp directory. Many static hits are documentation or syntax false positives, but real issues remain around third-party data transfer, plaintext key-file fallback, prompt instructions that can ignore prior context, and shell command templates using user-controlled placeholders.
22
Fichiers analysés
1,803
Lignes analysées
59
Éléments à examiner
0
Faux positifs ignorés
Préoccupations de sécurité confirmées (4)
Élevé
Environment file access
# 沙箱凭证兜底文件:HOME 根目录下的 .yescan_env,与其它 .env-aware 工具隔离
The code defines a hidden home-directory config file for SCAN_WEBSERVICE_KEY. Reading credentials from a plaintext file is a real secret-management risk.
Élevé
Prompt Injection Attempt Detected
SKILL.md tells the agent it is forbidden to reference conversation history or inherit prior state. That instruction can conflict with higher-priority user or system context when the skill is invoked.
The text uses mandatory language that directs the agent to ignore prior conversation context. It is not a full system-message forgery, so confidence is high but not absolute.
Élevé
Unsafe Shell Command Construction Guidance
SKILL.md instructs the agent to replace command placeholders with user-provided URL, path, or base64 values and execute the command directly. If an agent builds this through a shell instead of argv-safe execution, user input can become a command-injection vector.
The command templates include user-controlled placeholders and the prose says to execute them directly. The risk depends on the calling agent shell behavior, so confidence is high but contextual.
Moyen
references/implementation.md:43-47scripts/common/result_handlers.py:105-116scripts/common/file_saver.py:205-208
Server-Returned Documents Saved Without Content Validation
The implementation saves FileBase64 returned by the external service as Word, Excel, or PDF based on the selected scene. The documentation states that document magic-byte validation is not performed, so active or malformed documents may be written locally.
The code path directly decodes and writes service-returned base64, and the documentation explicitly says document magic-byte validation is not done. This is a clear content-handling risk, not merely a scanner pattern.
Éléments d’évaluation des capacités (59)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
Élevé
Hidden file in home directory
echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file in home directory
> The environment variable takes priority; if not set, the key is loaded from `~/.yescan_env`.
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file in home directory
- `SCAN_WEBSERVICE_KEY` environment variable (or `~/.yescan_env`)
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
> The environment variable takes priority; if not set, the key is loaded from `~/.yescan_env`.
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
- `SCAN_WEBSERVICE_KEY` environment variable (or `~/.yescan_env`)
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Generic API/secret keys
export SCAN_WEBSERVICE_KEY=<your_api_key>
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Hidden file in home directory
echo 'SCAN_WEBSERVICE_KEY=<你的密钥>' > ~/.yescan_env
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file in home directory
> 优先读取环境变量,未设置时自动从 `~/.yescan_env` 文件加载。
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file in home directory
- 配置 `SCAN_WEBSERVICE_KEY` 环境变量(或 `~/.yescan_env`)
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
echo 'SCAN_WEBSERVICE_KEY=<你的密钥>' > ~/.yescan_env
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
> 优先读取环境变量,未设置时自动从 `~/.yescan_env` 文件加载。
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
- 配置 `SCAN_WEBSERVICE_KEY` 环境变量(或 `~/.yescan_env`)
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file in home directory
### 3.1 推荐方式:写入 `~/.yescan_env`(永久生效)
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file in home directory
技能每次执行会读取 `~/.yescan_env`,无需重启会话。
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file in home directory
echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file in home directory
3. 如怀疑密钥泄露:在同一后台立即 *轮换* 或 *撤销* 旧密钥,并更新 `~/.yescan_env`
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
### 3.1 推荐方式:写入 `~/.yescan_env`(永久生效)
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
技能每次执行会读取 `~/.yescan_env`,无需重启会话。
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
3. 如怀疑密钥泄露:在同一后台立即 *轮换* 或 *撤销* 旧密钥,并更新 `~/.yescan_env`
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Generic API/secret keys
echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
'SCAN_WEBSERVICE_KEY=<your_api_key_here>' | Out-File -FilePath $HOME\.yescan_env -Encoding utf8
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
export SCAN_WEBSERVICE_KEY=<your_api_key_here>
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Hidden file in home directory
1. 确认 `~/.yescan_env` 中 `SCAN_WEBSERVICE_KEY` 不带引号、不带空格
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
1. 确认 `~/.yescan_env` 中 `SCAN_WEBSERVICE_KEY` 不带引号、不带空格
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
HTTP client library
response = self._send_request(param)
This call path sends the user-supplied image data or image URL to the Quark Scan King API. The outbound request is central to the skill and carries sensitive document content.
Élevé
HTTP client library
response = self._send_request(param)
This call path sends the user-supplied image data or image URL to the Quark Scan King API. The outbound request is central to the skill and carries sensitive document content.
Élevé
HTTP client library
response = self._send_request(param)
This call path sends the user-supplied image data or image URL to the Quark Scan King API. The outbound request is central to the skill and carries sensitive document content.
Élevé
HTTP client library
def _send_request(self, param: Dict[str, Any]) -> requests.Response:
This call path sends the user-supplied image data or image URL to the Quark Scan King API. The outbound request is central to the skill and carries sensitive document content.
Élevé
Python HTTP libraries
self.session = requests.Session()
The requests session and send method implement outbound calls to the Quark Scan King service. This creates third-party data transfer risk for user images.
Élevé
Python HTTP libraries
def _send_request(self, param: Dict[str, Any]) -> requests.Response:
The requests session and send method implement outbound calls to the Quark Scan King service. This creates third-party data transfer risk for user images.
Élevé
Hidden file in home directory
2. 用户 HOME 目录下的 ~/.yescan_env 文件(沙箱环境用,KEY=VALUE 文本格式)
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file in home directory
"""从 ~/.yescan_env 读取 KEY=VALUE,缺失或异常返回空串"""
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
2. 用户 HOME 目录下的 ~/.yescan_env 文件(沙箱环境用,KEY=VALUE 文本格式)
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
"""从 ~/.yescan_env 读取 KEY=VALUE,缺失或异常返回空串"""
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Generic API/secret keys
api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
if api_key:
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
return api_key
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
api_key = CredentialManager._read_from_file("SCAN_WEBSERVICE_KEY")
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
if api_key:
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
return api_key
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
def __init__(self, api_key: str, scene: str, data_type: str, platform: str = None):
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
self.api_key = api_key
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
"aiApiKey": self.api_key,
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
api_key = CredentialManager.load()
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Generic API/secret keys
api_key=api_key,
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Élevé
Hardcoded URL
API_URL = "https://scan-business.quark.cn/vision"
This is the hard-coded outbound API endpoint used by the client. User image data and the API key are sent to this external service during conversion.
Élevé
Hidden file in home directory
| API key stored in plaintext at `~/.yescan_env` | **disclosed**, standard practice | Recommend `chm
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
| API key stored in plaintext at `~/.yescan_env` | **disclosed**, standard practice | Recommend `chm
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file in home directory
**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Hidden file access
**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http
The skill uses ~/.yescan_env as a plaintext API-key fallback. Storing and reading a secret from a hidden home-directory file is a real credential exposure risk.
Élevé
Generic API/secret keys
**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Moyen
Temp file creation
import tempfile
The tempfile module is used to place converted documents under the system temp directory. These files can persist after conversion and may hold sensitive content.
Moyen
Temp file creation
DEFAULT_SAVE_DIR = tempfile.gettempdir()
The tempfile module is used to place converted documents under the system temp directory. These files can persist after conversion and may hold sensitive content.
Moyen
Python file write/append
with open(filepath, 'wb') as f:
The code writes decoded API-returned content to disk. Although the path is generated by the skill, the saved document can contain sensitive or active Office/PDF content.
Moyen
Python getenv function
api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Moyen
getenv function call
api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()
The skill requires SCAN_WEBSERVICE_KEY and loads or passes it for the external API request. This is expected functionality, but it handles a sensitive credential.
Facteurs de risque
🌐 Accès réseau (17)
examples/excel-example.md:40 examples/pdf-example.md:40 examples/word-example.md:40 scripts/common/messages.py:3 scripts/common/messages.py:4 scripts/common/ocr_client.py:125 scripts/common/ocr_client.py:155 scripts/common/ocr_client.py:174 scripts/common/ocr_client.py:196 scripts/common/ocr_client.py:86 scripts/common/ocr_client.py:196 scripts/common/ocr_client.py:212 scripts/common/runner.py:46 scripts/common/settings.py:18 SKILL.md:9 SKILL.md:17 SKILL.md:110
📁 Accès au système de fichiers (58)
examples/excel-example.md:24 examples/excel-example.md:31 examples/pdf-example.md:24 examples/pdf-example.md:31 examples/word-example.md:24 examples/word-example.md:31 README.md:27 README.md:28 README.md:30 README.md:59 README.md:27 README.md:28 README.md:30 README.md:59 README.zh-CN.md:27 README.zh-CN.md:28 README.zh-CN.md:30 README.zh-CN.md:59 README.zh-CN.md:27 README.zh-CN.md:28 README.zh-CN.md:30 README.zh-CN.md:59 references/implementation.md:28 references/implementation.md:44 references/implementation.md:44 references/privacy.md:31 references/privacy.md:33 references/privacy.md:38 references/privacy.md:39 references/privacy.md:60 references/privacy.md:64 references/privacy.md:31 references/privacy.md:33 references/privacy.md:38 references/privacy.md:39 references/privacy.md:60 references/privacy.md:64 references/privacy.md:20 references/troubleshooting.md:20 references/troubleshooting.md:22 references/troubleshooting.md:20 references/troubleshooting.md:22 scripts/common/__init__.py:7 scripts/common/file_saver.py:9 scripts/common/file_saver.py:51 scripts/common/file_saver.py:207 scripts/common/ocr_client.py:42 scripts/common/ocr_client.py:60 scripts/common/ocr_client.py:42 scripts/common/ocr_client.py:60 scripts/common/settings.py:11 scripts/common/settings.py:12 SECURITY.md:21 SECURITY.md:21 SECURITY.md:11 SKILL.md:17 SKILL.md:17 SKILL.md:78
🔑 Variables d’environnement (21)
README.md:23 README.md:27 references/privacy.md:38 references/privacy.md:45 references/privacy.md:51 scripts/common/ocr_client.py:50 scripts/common/ocr_client.py:50 scripts/common/ocr_client.py:50 scripts/common/ocr_client.py:51 scripts/common/ocr_client.py:52 scripts/common/ocr_client.py:53 scripts/common/ocr_client.py:54 scripts/common/ocr_client.py:55 scripts/common/ocr_client.py:80 scripts/common/ocr_client.py:82 scripts/common/ocr_client.py:181 scripts/common/result_handlers.py:48 scripts/common/result_handlers.py:84 scripts/common/runner.py:75 scripts/common/runner.py:77 SKILL.md:17
⚙️ Commandes externes (28)
references/privacy.md:42 references/privacy.md:44 references/troubleshooting.md:23 scripts/common/settings.py:7 scripts/common/settings.py:11 scripts/common/settings.py:12 scripts/common/settings.py:13 SKILL.md:15 SKILL.md:17 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:41-43 SKILL.md:43-52 SKILL.md:52-61 SKILL.md:61-63 SKILL.md:63 SKILL.md:64 SKILL.md:65-73 SKILL.md:73 SKILL.md:79-84 SKILL.md:84-89 SKILL.md:89-105 SKILL.md:105-118 SKILL.md:118-119 SKILL.md:119-120 SKILL.md:120-121 SKILL.md:121-122
Audité par: codex Voir l’historique des audits →
Partager et citer ce rapport
Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.
Copier le lien du rapport
https://skillstore.io/skills/yescan-ai-yescan-transoffice-universal/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/yescan-ai-yescan-transoffice-universal?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/yescan-ai-yescan-transoffice-universal?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/yescan-ai-yescan-transoffice-universal/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Carte intégrable
<iframe src="https://skillstore.io/embed/skills/yescan-ai-yescan-transoffice-universal.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citations académiques (APA · BibTeX · CFF)
Citation APA
yescan-ai. (2026). yescan-transoffice-universal security audit report (audit version 7) [Author version 1.1.4]. Skillstore. https://skillstore.io/skills/yescan-ai-yescan-transoffice-universal/audits/7Citation BibTeX
@techreport{yescan-ai-yescan-ai-yescan-transoffice-universal-2026,
author = {yescan-ai},
title = {yescan-transoffice-universal security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/yescan-ai-yescan-transoffice-universal/audits/7},
note = {Author version 1.1.4}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "yescan-transoffice-universal security audit report (audit version 7)"
version: "1.1.4"
type: report
authors:
- name: "yescan-ai"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/yescan-ai-yescan-transoffice-universal/audits/7"
identifiers:
- type: other
value: "skillstore:yescan-ai-yescan-transoffice-universal:audit:7"
description: "Skillstore immutable audit report identifier"
Score Skillstore
Pourquoi ce score Niveau de confiance des preuves: Moyen 82
Architecture
100
Maintenabilité
85
Contenu
73
Communauté
100
Conformité aux spécifications
Ce que vous pouvez créer
Transformer des captures d'écran de rapports en feuilles de calcul
Convertir une capture d'écran d'un tableau ou d'un rapport de ventes en fichier Excel modifiable.
Reconstruire des contrats numérisés en fichiers Word
Convertir une photo de contrat en document Word pouvant être relu et modifié.
Archiver des notes papier en PDF
Convertir une page numérisée ou une image de notes de réunion en PDF pour le partage et le stockage.
Essayez ces prompts
Convertir une image locale
Convertis cette image en Word : /path/to/document.jpg
Convertir une capture d'écran de tableau
Convertis cette capture d'écran de tableau en Excel et donne-moi le chemin du fichier enregistré : /path/to/table.png
Convertir depuis une URL
Convertis l'image à cette URL en PDF : https://example.com/scan.png
Choisir le meilleur format de sortie
Ce scan contient des paragraphes et un petit tableau. Convertis-le au format Office le plus modifiable : /path/to/scan.webp
Bonnes pratiques
- Confirmez que l'image ne contient aucune donnée sensible avant de l'envoyer au service tiers.
- Utilisez la scène fixe qui correspond au format de sortie souhaité.
- Supprimez les fichiers de sortie temporaires lorsqu'ils ne sont plus nécessaires.
Éviter
- N'utilisez pas cette skill pour une extraction de texte pure sans conversion de document.
- Ne traitez pas de dossiers privés sauf si le traitement par un tiers est approuvé.
- Ne transmettez pas de secrets non vérifiés ni de fichiers sans rapport comme entrée d'image.
Foire aux questions
Cette skill fonctionne-t-elle sans clé API ?
Non. Elle nécessite SCAN_WEBSERVICE_KEY depuis la console développeur Quark Scan King.
Où les fichiers convertis sont-ils enregistrés ?
Les fichiers convertis sont enregistrés dans le répertoire temporaire du système, comme /tmp ou %TEMP%.
La skill envoie-t-elle les images à un service externe ?
Oui. Elle envoie l'image ou l'URL d'image fournie par l'utilisateur à scan-business.quark.cn.
Peut-elle convertir plusieurs images à la fois ?
Non. Le flux de travail documenté traite une image par commande.
Quels formats sont pris en charge ?
Elle prend en charge les entrées d'image courantes et produit une sortie Word, Excel ou PDF.
Est-ce le bon outil pour l'amélioration d'images ?
Non. Cette skill est destinée à la conversion de documents, pas à l'amélioration d'images ni à l'extraction de texte OCR pure.