📦
yescan-scan-universal
38Quark Scan Kingでスキャン画像を強化
低品質の文書写真やスクリーンショットは、読みにくく再利用もしにくいものです。このスキルは承認済みの画像1枚をQuark Scan Kingに送信し、よりきれいなローカル画像ファイルを返します。
デザイン＆クリエイティブ 表示
スキル yescan-ocr-universal
📦
yescan-ocr-universal
v1.1.4 コンテンツリビジョン r1 高リスク 🌐 ネットワークアクセス📁 ファイルシステムへのアクセス🔑 環境変数⚙️ 外部コマンド⚡ スクリプトを含む
OCRで画像からテキストを抽出
画像やスキャンされたドキュメントには、再利用しにくいテキストが含まれていることがよくあります。このスキルは1つの画像をOCRサービスに送信し、一致するドキュメントタイプに応じた構造化テキストを返します。
対応: Claude Codex Code(CC)
インストール前に停止して確認を求めてください。
計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "yescan-ocr-universal" from https://skillstore.io/skills/yescan-ai-yescan-ocr-universal.md and its manifest at https://skillstore.io/api/skills/yescan-ai-yescan-ocr-universal/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「yescan-ocr-universal」を使用しています。 VAT請求書の写真。
期待される結果:
- 請求書タイプ、請求書番号、発行日、売り手、買い手、税額、合計が構造化フィールドとして返されます。
- 結果は経理レビューのワークフローにコピーできます。
「yescan-ocr-universal」を使用しています。 表を含むスクリーンショット。
期待される結果:
- 行、列、セル内テキストが表形式の構造で返されます。
- 結合されたセルや不明瞭なセルは、手動レビューが必要になる場合があります。
「yescan-ocr-universal」を使用しています。 翻訳対象の外国語メニュー画像。
期待される結果:
- 認識されたテキストと翻訳されたテキストが返されます。
- 翻訳済み画像がローカルに保存され、そのパスが返されます。
セキュリティ監査
高リスクv6 • 2026/7/9 バージョン別レポートを開く
The skill is an OCR client that sends user images and SCAN_WEBSERVICE_KEY to the Quark Scan King service and can write translated images to /tmp/imgs. Confirmed risks include outbound sensitive document transfer, plaintext hidden API-key storage, temporary output files, and secret handling; most command execution, Windows Credential Manager, obfuscation, and high-entropy alerts are false positives from markdown or ordinary image/Base64 handling. No prompt injection attempt was found.
38
スキャンされたファイル
2,951
解析済み行数
72
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (4)
高
Environment file access
# 沙箱凭证兜底文件:HOME 根目录下的 .yescan_env,与其它 .env-aware 工具隔离
The code explicitly uses a home-directory .yescan_env file as credential fallback. This is a real environment-file secret access pattern.
高
Sensitive Document Images Sent to Third-Party OCR Service
The skill explicitly supports IDs, social security cards, travel permits, degree certificates, tickets, invoices, medical reports, and other sensitive documents. The privacy documentation states user-provided images are sent to scan-business.quark.cn for OCR, so sensitive personal or regulated data leaves the user environment.
The supported scenes include multiple PII and medical document types, and the privacy table confirms image data is transmitted to a third-party OCR service.
中
API Key Transport Documentation Mismatch
The privacy and security documents describe SCAN_WEBSERVICE_KEY as sent in an HTTP header. The implementation instead places the key in the JSON request body as aiApiKey, which weakens auditability and may mislead users reviewing exposure paths.
The documentation says the key is sent as a header, while the request builder clearly includes aiApiKey inside the JSON payload.
中
Arbitrary URL Forwarding Without Private Address Filtering
The URL validator accepts any http or https URL and does not block private, loopback, or metadata addresses before forwarding dataUrl to the OCR service. If the upstream service fetches supplied URLs, this can enable abuse of the provider as a URL fetcher.
The local validator only checks scheme and parseability, then the client forwards the URL as dataUrl. Impact depends on upstream fetch behavior, so confidence is high enough to retain but not maximal.
機能レビュー項目 (72)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
高
Hidden file in home directory
echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file in home directory
chmod 600 ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file in home directory
> The environment variable takes priority; if not set, the key is loaded from `~/.yescan_env`.
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file in home directory
- `SCAN_WEBSERVICE_KEY` environment variable (or `~/.yescan_env`)
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file access
echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file access
chmod 600 ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file access
> The environment variable takes priority; if not set, the key is loaded from `~/.yescan_env`.
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file access
- `SCAN_WEBSERVICE_KEY` environment variable (or `~/.yescan_env`)
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Generic API/secret keys
export SCAN_WEBSERVICE_KEY=<your_api_key>
The documentation requires SCAN_WEBSERVICE_KEY, which is an API credential used by the skill. Secret configuration is expected but remains a real secret-handling risk.
高
Generic API/secret keys
echo 'SCAN_WEBSERVICE_KEY=<your_api_key>' > ~/.yescan_env
The documentation requires SCAN_WEBSERVICE_KEY, which is an API credential used by the skill. Secret configuration is expected but remains a real secret-handling risk.
高
Hidden file in home directory
echo 'SCAN_WEBSERVICE_KEY=<你的密钥>' > ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file in home directory
chmod 600 ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file in home directory
> 优先读取环境变量,未设置时自动从 `~/.yescan_env` 文件加载。
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file in home directory
- 配置 `SCAN_WEBSERVICE_KEY` 环境变量(或 `~/.yescan_env`)
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file access
echo 'SCAN_WEBSERVICE_KEY=<你的密钥>' > ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file access
chmod 600 ~/.yescan_env
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file access
> 优先读取环境变量,未设置时自动从 `~/.yescan_env` 文件加载。
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file access
- 配置 `SCAN_WEBSERVICE_KEY` 环境变量(或 `~/.yescan_env`)
The documentation instructs users to create or rely on ~/.yescan_env for the API key. A plaintext hidden home-directory credential file is a real credential-at-rest risk even when disclosed.
高
Hidden file in home directory
### 3.1 推荐方式:写入 `~/.yescan_env`(永久生效)
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file in home directory
技能每次执行会读取 `~/.yescan_env`,无需重启会话。
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file in home directory
echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file in home directory
chmod 600 ~/.yescan_env
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file in home directory
3. 如怀疑密钥泄露:在同一后台立即 *轮换* 或 *撤销* 旧密钥,并更新 `~/.yescan_env`
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file in home directory
- [x] `~/.yescan_env` 设为 `0600` 权限,避免同机其他用户读取
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file access
### 3.1 推荐方式:写入 `~/.yescan_env`(永久生效)
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file access
技能每次执行会读取 `~/.yescan_env`,无需重启会话。
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file access
echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file access
chmod 600 ~/.yescan_env
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file access
3. 如怀疑密钥泄露:在同一后台立即 *轮换* 或 *撤销* 旧密钥,并更新 `~/.yescan_env`
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Hidden file access
- [x] `~/.yescan_env` 设为 `0600` 权限,避免同机其他用户读取
The privacy document instructs users to store SCAN_WEBSERVICE_KEY in ~/.yescan_env. This is a plaintext hidden home-directory credential file and is a real local secret exposure risk.
高
Generic API/secret keys
echo 'SCAN_WEBSERVICE_KEY=<your_api_key_here>' > ~/.yescan_env
The privacy document configures SCAN_WEBSERVICE_KEY as the service credential. Handling an API secret is expected for this skill but remains security-relevant.
高
Generic API/secret keys
'SCAN_WEBSERVICE_KEY=<your_api_key_here>' | Out-File -FilePath $HOME\.yescan_env -Encoding utf8
The privacy document configures SCAN_WEBSERVICE_KEY as the service credential. Handling an API secret is expected for this skill but remains security-relevant.
高
Generic API/secret keys
export SCAN_WEBSERVICE_KEY=<your_api_key_here>
The privacy document configures SCAN_WEBSERVICE_KEY as the service credential. Handling an API secret is expected for this skill but remains security-relevant.
高
Hidden file in home directory
| A0100 | 凭证无效 | 1. 确认 `~/.yescan_env` 存在且包含 `SCAN_WEBSERVICE_KEY=<key>`<br>2. 确认 key 无前后空格或引号问题<br>
The troubleshooting guidance relies on ~/.yescan_env containing SCAN_WEBSERVICE_KEY. This confirms the skill ecosystem uses a plaintext hidden credential file.
高
Hidden file access
| A0100 | 凭证无效 | 1. 确认 `~/.yescan_env` 存在且包含 `SCAN_WEBSERVICE_KEY=<key>`<br>2. 确认 key 无前后空格或引号问题<br>
The troubleshooting guidance relies on ~/.yescan_env containing SCAN_WEBSERVICE_KEY. This confirms the skill ecosystem uses a plaintext hidden credential file.
高
HTTP client library
response = self._send_request(param)
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
高
HTTP client library
response = self._send_request(param)
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
高
HTTP client library
response = self._send_request(param)
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
高
HTTP client library
def _send_request(self, param: Dict[str, Any]) -> requests.Response:
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
高
Python HTTP libraries
self.session = requests.Session()
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
高
Python HTTP libraries
def _send_request(self, param: Dict[str, Any]) -> requests.Response:
This client creates a requests session and posts user image data plus aiApiKey to the configured OCR API. That outbound transfer is intended but security-relevant.
高
Hidden file in home directory
2. 用户 HOME 目录下的 ~/.yescan_env 文件(沙箱环境用,KEY=VALUE 文本格式)
The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.
高
Hidden file in home directory
"""从 ~/.yescan_env 读取 KEY=VALUE,缺失或异常返回空串"""
The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.
高
Hidden file access
2. 用户 HOME 目录下的 ~/.yescan_env 文件(沙箱环境用,KEY=VALUE 文本格式)
The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.
高
Hidden file access
"""从 ~/.yescan_env 读取 KEY=VALUE,缺失或异常返回空串"""
The credential loader reads ~/.yescan_env from the user home directory. Reading a hidden plaintext key file is a real local secret-handling risk.
高
Python getenv function
api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
getenv function call
api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
Generic API/secret keys
api_key = os.getenv("SCAN_WEBSERVICE_KEY", "").strip()
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
Generic API/secret keys
if api_key:
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
Generic API/secret keys
return api_key
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
Generic API/secret keys
api_key = CredentialManager._read_from_file("SCAN_WEBSERVICE_KEY")
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
Generic API/secret keys
if api_key:
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
Generic API/secret keys
return api_key
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
Generic API/secret keys
def __init__(self, api_key: str, scene: str, data_type: str, platform: str = None):
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
Generic API/secret keys
self.api_key = api_key
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
Generic API/secret keys
"aiApiKey": self.api_key,
The code loads SCAN_WEBSERVICE_KEY and stores it as the API credential used for OCR requests. Access to this secret is required but security-relevant.
高
Generic API/secret keys
api_key = CredentialManager.load()
The runner loads SCAN_WEBSERVICE_KEY through CredentialManager before creating the OCR client. This is direct use of a service API secret.
高
Generic API/secret keys
api_key=api_key,
The runner loads SCAN_WEBSERVICE_KEY through CredentialManager before creating the OCR client. This is direct use of a service API secret.
高
Hardcoded URL
API_URL = "https://scan-business.quark.cn/vision"
API_URL is the hard-coded destination for all OCR requests. It confirms that user image data is sent to an external third-party service.
高
Hidden file in home directory
| API key stored in plaintext at `~/.yescan_env` | **disclosed**, standard practice | Recommend `chm
The security policy confirms the API key may be stored in plaintext at ~/.yescan_env. That is a real credential-at-rest risk even with chmod guidance.
高
Hidden file access
| API key stored in plaintext at `~/.yescan_env` | **disclosed**, standard practice | Recommend `chm
The security policy confirms the API key may be stored in plaintext at ~/.yescan_env. That is a real credential-at-rest risk even with chmod guidance.
高
Hidden file in home directory
**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http
The skill instructions tell users to write SCAN_WEBSERVICE_KEY to ~/.yescan_env. This is a plaintext hidden home-directory credential file.
高
Hidden file access
**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http
The skill instructions tell users to write SCAN_WEBSERVICE_KEY to ~/.yescan_env. This is a plaintext hidden home-directory credential file.
高
Generic API/secret keys
**配置 API 密钥**:将 `SCAN_WEBSERVICE_KEY=<your_api_key>` 写入 `~/.yescan_env`(每次执行自动读取,无需重启)。获取入口:访问 `http
The skill instructions require SCAN_WEBSERVICE_KEY as the API credential. Secret configuration is necessary but remains a real security concern.
中
Temp directory access
"translated_image_path": "/tmp/imgs/1728912345_a1b2c3d4e5f67890.png",
The example documents translated image output under /tmp/imgs, matching the implementation behavior. This can leave sensitive translated images in temporary storage until deleted.
中
Temp directory access
> 翻译完成,译图已保存:`/tmp/imgs/1728912345_a1b2c3d4e5f67890.png`,可直接打开查看。
The example documents translated image output under /tmp/imgs, matching the implementation behavior. This can leave sensitive translated images in temporary storage until deleted.
中
Temp directory access
- **pic-translate 场景例外**:图片翻译场景会将译图保存到系统临时目录(`/tmp/imgs`),文件不会自动清理。
The privacy document discloses that pic-translate writes translated images to /tmp/imgs and does not automatically clean them up. Temporary storage can retain sensitive image content.
中
Temp file creation
import tempfile
The implementation uses tempfile.gettempdir as the default save root for generated output. This creates local artifacts in temporary storage that may contain sensitive translated images.
中
Temp file creation
DEFAULT_SAVE_DIR = tempfile.gettempdir()
The implementation uses tempfile.gettempdir as the default save root for generated output. This creates local artifacts in temporary storage that may contain sensitive translated images.
中
Python file write/append
with open(filepath, 'wb') as f:
The code writes Base64-decoded service output to disk. The path is generated by the saver, but the saved content can still contain sensitive user data and requires cleanup controls.
中
Temp directory access
| Translated image (`pic-translate` only) | **local write** | `/tmp/imgs/` | depends on content |
The security policy discloses translated images are written to /tmp/imgs. Local temporary image artifacts can retain sensitive content and need cleanup controls.
中
Temp directory access
- Write output files to disk — except `pic-translate` scene, which saves the translated image to `/t
The security policy discloses translated images are written to /tmp/imgs. Local temporary image artifacts can retain sensitive content and need cleanup controls.
リスク要因
🌐 ネットワークアクセス (34)
examples/business-license-ocr-example.md:45 examples/commercial-invoice-ocr-example.md:47 examples/degree-certificate-ocr-example.md:46 examples/driver-license-ocr-example.md:45 examples/formula-ocr-example.md:40 examples/general-ocr-example.md:40 examples/handwritten-ocr-example.md:40 examples/idcard-ocr-example.md:45 examples/medical-report-ocr-example.md:45 examples/pharmaceutical-inspection-report-example.md:47 examples/pic-translate-example.md:41 examples/product-image-ocr-example.md:40 examples/question-ocr-example.md:40 examples/social-security-card-ocr-example.md:44 examples/table-ocr-example.md:49 examples/train-ticket-ocr-example.md:47 examples/travel-permit-ocr-example.md:44 examples/vat-invoice-ocr-example.md:47 examples/vehicle-license-ocr-example.md:45 references/implementation.md:14 scripts/common/messages.py:3 scripts/common/messages.py:4 scripts/common/ocr_client.py:125 scripts/common/ocr_client.py:155 scripts/common/ocr_client.py:174 scripts/common/ocr_client.py:196 scripts/common/ocr_client.py:86 scripts/common/ocr_client.py:196 scripts/common/ocr_client.py:212 scripts/common/runner.py:46 scripts/common/settings.py:18 SKILL.md:9 SKILL.md:17 SKILL.md:190
📁 ファイルシステムへのアクセス (49)
examples/pic-translate-example.md:24 examples/pic-translate-example.md:32 README.md:43 README.md:44 README.md:46 README.md:91 README.md:43 README.md:44 README.md:46 README.md:91 README.zh-CN.md:43 README.zh-CN.md:44 README.zh-CN.md:46 README.zh-CN.md:91 README.zh-CN.md:43 README.zh-CN.md:44 README.zh-CN.md:46 README.zh-CN.md:91 references/privacy.md:26 references/privacy.md:28 references/privacy.md:33 references/privacy.md:34 references/privacy.md:55 references/privacy.md:59 references/privacy.md:26 references/privacy.md:28 references/privacy.md:33 references/privacy.md:34 references/privacy.md:55 references/privacy.md:59 references/privacy.md:22 references/troubleshooting.md:11 references/troubleshooting.md:11 scripts/common/__init__.py:7 scripts/common/file_saver.py:9 scripts/common/file_saver.py:54 scripts/common/file_saver.py:210 scripts/common/ocr_client.py:42 scripts/common/ocr_client.py:60 scripts/common/ocr_client.py:42 scripts/common/ocr_client.py:60 scripts/common/settings.py:11 scripts/common/settings.py:12 SECURITY.md:22 SECURITY.md:22 SECURITY.md:12 SECURITY.md:44 SKILL.md:17 SKILL.md:17
🔑 環境変数 (21)
README.md:39 README.md:43 references/privacy.md:33 references/privacy.md:40 references/privacy.md:46 scripts/common/ocr_client.py:50 scripts/common/ocr_client.py:50 scripts/common/ocr_client.py:50 scripts/common/ocr_client.py:51 scripts/common/ocr_client.py:52 scripts/common/ocr_client.py:53 scripts/common/ocr_client.py:54 scripts/common/ocr_client.py:55 scripts/common/ocr_client.py:80 scripts/common/ocr_client.py:82 scripts/common/ocr_client.py:181 scripts/common/result_handlers.py:48 scripts/common/result_handlers.py:84 scripts/common/runner.py:75 scripts/common/runner.py:77 SKILL.md:17
⚙️ 外部コマンド (43)
references/privacy.md:37 references/privacy.md:39 scripts/common/settings.py:7 scripts/common/settings.py:11 scripts/common/settings.py:12 scripts/common/settings.py:13 SKILL.md:15 SKILL.md:17 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:41-43 SKILL.md:43-52 SKILL.md:52-61 SKILL.md:61-63 SKILL.md:63 SKILL.md:64 SKILL.md:65-73 SKILL.md:73 SKILL.md:79-84 SKILL.md:84-89 SKILL.md:89-94 SKILL.md:94-99 SKILL.md:99-104 SKILL.md:104-109 SKILL.md:109-114 SKILL.md:114-119 SKILL.md:119-124 SKILL.md:124-129 SKILL.md:129-134 SKILL.md:134-139 SKILL.md:139-144 SKILL.md:144-149 SKILL.md:149-154 SKILL.md:154-159 SKILL.md:159-164 SKILL.md:164-169 SKILL.md:169-185 SKILL.md:185-198 SKILL.md:198-199 SKILL.md:199-200 SKILL.md:200-201 SKILL.md:201-202
⚡ スクリプトを含む (1)
監査者: codex 監査履歴を表示 →
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/yescan-ai-yescan-ocr-universal?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/yescan-ai-yescan-ocr-universal?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/yescan-ai-yescan-ocr-universal/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/yescan-ai-yescan-ocr-universal.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
yescan-ai. (2026). yescan-ocr-universal security audit report (audit version 6) [Author version 1.1.4]. Skillstore. https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6BibTeX形式の引用
@techreport{yescan-ai-yescan-ai-yescan-ocr-universal-2026,
author = {yescan-ai},
title = {yescan-ocr-universal security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6},
note = {Author version 1.1.4}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "yescan-ocr-universal security audit report (audit version 6)"
version: "1.1.4"
type: report
authors:
- name: "yescan-ai"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/yescan-ai-yescan-ocr-universal/audits/6"
identifiers:
- type: other
value: "skillstore:yescan-ai-yescan-ocr-universal:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 82
アーキテクチャ
100
保守性
87
コンテンツ
71
コミュニティ
100
仕様準拠
作成できるもの
ビジネス文書のデジタル化
請求書、営業許可証、チケット、フォームから主要フィールドを抽出し、記録入力を高速化します。
経理証憑の処理
払い戻しや監査レビューの前に、VAT請求書、列車チケット、商業送り状を読み取ります。
学習教材の変換
授業や研究の画像から、数式、問題、表、手書きノートを認識します。
これらのプロンプトを試す
基本テキストを抽出
Extract the text from this image: /path/to/image.png
請求書を読み取る
Read this invoice image and return the seller, buyer, date, line items, tax amount, and total: /path/to/invoice.jpg
表を認識
Extract the table from this screenshot and keep the row and column structure: /path/to/table.png
分類して抽出
Identify the best OCR scene for this document, extract the key fields, and preserve important labels: /path/to/document.webp
ベストプラクティス
- 機密性の高い画像を送信する前に、ユーザーがサードパーティOCR処理を承認していることを確認してください。
- 可能な場合は、APIキーに環境変数または保護されたシークレットストアを使用してください。
- 一時的な翻訳済み画像ファイルは、不要になったら削除してください。
回避
- 明確なコンプライアンス上の根拠なしに、政府発行ID、医療レポート、または財務記録を処理しないでください。
- ディレクトリパスを渡したり、1回の実行で多数のファイルをスキャンするようスキルに依頼したりしないでください。
- APIキーをプロンプト、コマンド引数、スクリーンショット、共有ログに貼り付けないでください。
よくある質問
このスキルはAPIキーなしで動作しますか？
いいえ。Quark Scan Kingサービス用のSCAN_WEBSERVICE_KEYが必要です。
ローカル画像ファイルを処理できますか？
はい。ユーザーが指定した1つのローカル画像パスを読み取り、画像コンテンツをOCRに送信できます。
画像データはどこに送信されますか？
このスキルはOCR処理のために画像入力をscan-business.quark.cnに送信します。
スキャンされた表に対応していますか？
はい。画像に表が含まれ、行と列の構造を保持する必要がある場合は、table OCRシーンを使用してください。
画像内のテキストを翻訳できますか？
はい。pic-translateシーンは翻訳されたテキストを返し、翻訳済み画像をローカルに保存します。
複数の画像を一度に処理できますか？
いいえ。ドキュメント化されたワークフローでは、1回の呼び出しにつき1つの画像を処理します。
開発者情報
作成者
yescan-aiライセンス
MIT
作者バージョン
v1.1.4
Skillstore リビジョン
r1
参照
26421118b848d9f1efc0aa169d8a7a9e7e0a877e
メンテナンスの新しさ
2026/7/20
利用状況
29 ダウンロード · 0 閲覧
ファイル構成
📄 business-license-ocr-example.md
📄 commercial-invoice-ocr-example.md
📄 degree-certificate-ocr-example.md
📄 driver-license-ocr-example.md
📄 medical-report-ocr-example.md
📄 pharmaceutical-inspection-report-example.md
📄 product-image-ocr-example.md
📄 social-security-card-ocr-example.md
📄 travel-permit-ocr-example.md
📄 vehicle-license-ocr-example.md
📁 scripts/
📁 common/
📄 scan.py
📄 LICENSE
📄 SKILL.md
yescan-ai のその他のスキル
すべて表示📦
yescan-transoffice-universal
38スキャン画像をOfficeファイルに変換
スキャン画像は、ユーザーが編集する前に手入力で再入力が必要になることがよくあります。このスキルは、Quark Scan Kingを通じて1つの画像をWord、Excel、またはPDFに変換します。
オフィス＆レポート 表示
📦
yescan-universal
38Quark Scan OCRで画像を処理
画像を多用するワークフローでは、多くの場合、さまざまな形式にわたるOCR、クリーンアップ、翻訳、ドキュメント変換が必要です。このスキルは、明確なセットアップ手順と検証手順に沿って、ユーザー提供の画像をyescan CLIとQuark Scanサービスにルーティングします。
生産性 表示
関連スキル
すべて表示📦
pdf-processing
79信頼性の高い抽出でPDFを処理
作成者 0xkynz
PDFワークフローでは、一貫性のない文書を対象に、テキスト、表、フォーム、ページ操作が必要になることがよくあります。このスキルは、Claude、Codex、Claude Codeに実践的なPDF処理タスクの進め方を示します。
データ＆アナリティクス 表示
📦
glm4v-analyze-image
79GLM-4Vで画像を分析
作成者 CK991357
画像レビューでは、短いキャプションだけでなく、構造化された視覚的推論が必要になることがよくあります。このスキルは、説明、視覚的な質問、OCR、詳細抽出のためのGLM-4Vプロンプト作成をガイドします。
データ＆アナリティクス 表示
📦
azure-ai-vision-imageanalysis-py
79Azure AI Vision Pythonで画像を分析する
作成者 sickn33
画像分析ワークフローでは、SDKサンプルを一から作り直すことなく、キャプション、OCR、検出、トリミングが必要です。このスキルは、Claude、Codex、Claude CodeがPython向けAzure AI Vision Image Analysisを扱うためのガイドです。
データ＆アナリティクス 表示
📦
pdf-analyze
80PDFドキュメントの分析と入力
作成者 21pounder
PDFワークフローでは、多数のドキュメントにわたって抽出、変換、結合、フォーム入力が必要になることがよくあります。このスキルは、再現可能なPDF処理のための実用的なPythonおよびコマンドラインレシピを提供します。
オフィス＆レポート 表示
📦
pdf-processing-pro
79フォーム、表、OCRを含むPDFを処理する
作成者 davila7
PDFワークフローでは、多くの場合、信頼性の高い抽出、検証、バッチ処理が必要です。このスキルは、フォーム、表、OCR、チェックに関する実用的なPDFワークフローをClaude、Codex、Claude Codeに提供します。
オフィス＆レポート 表示
📦
azure-ai-translation-ts
79TypeScriptでAzure翻訳クライアントを構築する
作成者 sickn33
開発者には、TypeScriptでAzureのテキスト翻訳とドキュメント翻訳を行うための明確な例が必要です。このスキルは、RESTクライアントのセットアップ、認証、翻訳フロー、ステータス確認、ベストプラクティスを提供します。
コーディング＆開発 表示