技能 yescan-universal
📦
yescan-universal
v1.0.5 内容修订 r1 高风险 🔑 环境变量🌐 网络访问📁 文件系统访问⚙️ 外部命令
使用 Quark Scan OCR 处理图像
以图像为主的工作流通常需要在多种格式之间进行 OCR、清理、翻译和文档转换。此技能通过 yescan CLI 和 Quark Scan 服务处理用户提供的图像，并包含明确的设置和验证步骤。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "yescan-universal" from https://skillstore.io/skills/yescan-ai-yescan-universal.md and its manifest at https://skillstore.io/api/skills/yescan-ai-yescan-universal/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“yescan-universal”。 用户提供一张收据照片并请求 OCR。
预期结果:
助手检查 yescan 设置，选择匹配的 OCR 场景，运行命令，并返回提取出的收据文本。
正在使用“yescan-universal”。 用户提供一张模糊的扫描表单并请求清理。
预期结果:
助手选择增强场景，处理图像，验证成功，并给出本地输出文件路径。
正在使用“yescan-universal”。 用户提供一张电子表格图像并请求转换为 Excel。
预期结果:
助手发现转换场景，在图像上运行该场景，并报告生成的电子表格路径。
安全审计
高风险v3 • 2026/7/8 打开版本化报告
The reviewed files are readable documentation and skill instructions, not obfuscated payloads. The main confirmed risks are third-party image upload, API key handling, hidden credential storage, temp-file outputs, and yescan or pip command execution. I found no evidence of prompt injection, hidden endpoints, or attempts to bypass the audit.
7
已扫描文件
488
分析行数
35
复核项
0
已忽略误报
已确认安全问题 (1)
高
Third-Party Image and Credential Transmission
The skill sends user-provided images and SCAN_WEBSERVICE_KEY to Quark Scan services. Images may contain personal, financial, or regulated information.
The privacy and implementation documents explicitly state that user images and the API key leave the machine for Quark Scan processing.
能力复核项 (35)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Generic API/secret keys
yescan config set SCAN_WEBSERVICE_KEY <your_api_key>
The line instructs users to configure or export SCAN_WEBSERVICE_KEY, a real service credential. It is a legitimate setup step, but mishandling the key can expose account access.
高
Generic API/secret keys
yescan config set SCAN_WEBSERVICE_KEY <your_api_key>
The line instructs users to configure or export SCAN_WEBSERVICE_KEY, a real service credential. It is a legitimate setup step, but mishandling the key can expose account access.
高
Hidden file in home directory
配置保存在 `~/.yescan/config.json`。
The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.
高
Hidden file in home directory
> 优先级:CLI config(`~/.yescan/config.json`)> 环境变量
The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.
高
Generic API/secret keys
yescan config set SCAN_WEBSERVICE_KEY <your_api_key_here>
The line instructs users to configure or export SCAN_WEBSERVICE_KEY, a real service credential. It is a legitimate setup step, but mishandling the key can expose account access.
高
Generic API/secret keys
export SCAN_WEBSERVICE_KEY=<your_api_key_here>
The line instructs users to configure or export SCAN_WEBSERVICE_KEY, a real service credential. It is a legitimate setup step, but mishandling the key can expose account access.
高
Hidden file in home directory
| API key stored via `yescan config` (`~/.yescan/config.json`) | **disclosed**, standard practice |
The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.
高
Generic API/secret keys
- 设置命令:`yescan config set SCAN_WEBSERVICE_KEY <your_api_key>`
The line instructs users to configure or export SCAN_WEBSERVICE_KEY, a real service credential. It is a legitimate setup step, but mishandling the key can expose account access.
中
Hardcoded URL
→ POST https://scan-business.quark.cn/vision
The implementation documents a POST to https://scan-business.quark.cn/vision. This is a real external service call that can transmit user images and credentials.
中
Temp directory access
"path": "/tmp/imgs/<Unix时间戳>_<16位随机十六进制串>.<扩展名>"
The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.
中
Temp directory access
| 图像增强 | 图片落盘 | 系统临时目录下的 `imgs/` 子目录(如 `/tmp/imgs/`)或 `--output` 目录 |
The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.
中
Temp directory access
| 文档转换 | 文档落盘 | 系统临时目录下的 `documents/` 子目录(如 `/tmp/documents/`)或 `--output` 目录 |
The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.
中
Temp directory access
| AIGC 生成 | 图片落盘 | 系统临时目录下的 `imgs/` 子目录(如 `/tmp/imgs/`)或 `--output` 目录 |
The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.
中
Hidden file access
配置保存在 `~/.yescan/config.json`。
The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.
中
Hidden file access
> 优先级:CLI config(`~/.yescan/config.json`)> 环境变量
The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.
中
Temp directory access
- **图像增强场景**:输出增强后图片到系统临时目录下的 `imgs/` 子目录(如 `/tmp/imgs/`)或 `--output` 指定目录
The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.
中
Temp directory access
- **文档转换场景**:输出文档文件到系统临时目录下的 `documents/` 子目录(如 `/tmp/documents/`)或 `--output` 指定目录
The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.
中
Temp directory access
- **AIGC 场景**:输出生成图片到系统临时目录下的 `imgs/` 子目录(如 `/tmp/imgs/`)或 `--output` 指定目录
The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.
中
Hidden file access
| API key stored via `yescan config` (`~/.yescan/config.json`) | **disclosed**, standard practice |
The documentation states that the API key is stored in ~/.yescan/config.json. Hidden home-directory credential storage is real and requires strict file permissions and rotation guidance.
中
Temp directory access
| Output files written to system temp dir's `imgs/` and `documents/` subdirs (e.g. `/tmp/imgs/`, `/t
The skill writes processed image or document outputs to system temp directories. Sensitive OCR or document outputs could remain on disk until removed.
中
Ruby/shell backtick execution
1. `yescan --version` — 未安装则执行 `pip3 install yescan`;若版本 < 1.0.5,执行 `pip3 install yescan --upgrade`,
The skill instructs agents to run yescan --version and pip3 install or upgrade yescan. Installing or upgrading packages at runtime is real command execution and supply-chain exposure.
中
Ruby/shell backtick execution
2. `pip3 index versions yescan` — 若 INSTALLED < LATEST,告知用户有新版本可用并提供升级命令:`pip3 install yescan --upgr
The skill instructs agents to run pip3 index versions yescan and provide an upgrade command. This is real external command usage tied to package management.
中
Ruby/shell backtick execution
- **密钥检查**:`yescan config get SCAN_WEBSERVICE_KEY`,未配置则引导用户配置
The skill instructs agents to run yescan config get SCAN_WEBSERVICE_KEY. This executes the CLI and reads credential configuration state.
中
Ruby/shell backtick execution
- 设置命令:`yescan config set SCAN_WEBSERVICE_KEY <your_api_key>`
The skill provides a yescan config set command for an API key. This is real CLI execution involving secret material.
中
Ruby/shell backtick execution
```bash
The code block instructs agents to run yescan scene-discovery commands. These are intended external CLI calls, even though they are part of normal operation.
中
Ruby/shell backtick execution
```
The surrounding gate requires CLI output before proceeding. This reinforces mandatory external command execution during skill use.
中
Ruby/shell backtick execution
1. 未执行 `yescan --version` 确认安装状态 → 禁止继续
The gate requires yescan --version before continuing. This is an explicit external command prerequisite.
中
Ruby/shell backtick execution
3. 未执行 `pip3 index versions yescan` 确认最新版本状态 → 禁止继续
The gate requires pip3 index versions yescan before continuing. This is an explicit package-management command prerequisite.
中
Ruby/shell backtick execution
4. 未执行 `yescan config get SCAN_WEBSERVICE_KEY` 确认密钥已配置 → 禁止继续
The gate requires yescan config get SCAN_WEBSERVICE_KEY before continuing. This reads secret configuration state through an external CLI.
中
Ruby/shell backtick execution
- 未执行过 `--list-scenes` 则不得进入 Execute
The gate requires --list-scenes before execution. That is a real yescan CLI command used to choose later actions.
中
Ruby/shell backtick execution
```bash
The execute block gives yescan commands that process user-provided paths or URLs. This is the main external command surface of the skill.
中
Ruby/shell backtick execution
```
The surrounding execute section describes yescan command arguments for local paths and URLs. It is part of the command execution workflow.
中
Ruby/shell backtick execution
> `--path` 传本地文件路径,`--url` 传 http/https 链接。
The line defines --path and --url inputs to the yescan CLI. User-provided files or URLs become command arguments and need validation.
中
Ruby/shell backtick execution
- 多步处理为逐步 Execute → Verify 循环:step N+1 的命令在 step N Verify 通过后才构造,`--path` 取自 step N 响应中的 `data.path`
The workflow builds later commands from earlier data.path outputs. Chained command construction is real and should guard against unsafe paths.
中
Ruby/shell backtick execution
- 根据错误信息自行修复(如场景名无效 → 重新 `--list-scenes`)或将错误原因告知用户
The troubleshooting gate can rerun --list-scenes after errors. It remains a real external CLI invocation, though within a recovery path.
风险因素
🔑 环境变量 (5)
🌐 网络访问 (3)
📁 文件系统访问 (14)
references/implementation.md:45 references/implementation.md:65 references/implementation.md:66 references/implementation.md:67 references/privacy.md:34 references/privacy.md:42 references/privacy.md:34 references/privacy.md:42 references/privacy.md:21 references/privacy.md:22 references/privacy.md:23 SECURITY.md:21 SECURITY.md:21 SECURITY.md:22
⚙️ 外部命令 (23)
SKILL.md:20 SKILL.md:21 SKILL.md:22 SKILL.md:23 SKILL.md:29-32 SKILL.md:32-38 SKILL.md:38-40 SKILL.md:40-41 SKILL.md:41-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-53 SKILL.md:53-54 SKILL.md:54 SKILL.md:56 SKILL.md:59 SKILL.md:64-68 SKILL.md:68-70 SKILL.md:70 SKILL.md:81-88 SKILL.md:88 SKILL.md:89
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/yescan-ai-yescan-universal/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/yescan-ai-yescan-universal?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/yescan-ai-yescan-universal?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/yescan-ai-yescan-universal/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/yescan-ai-yescan-universal.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
yescan-ai. (2026). yescan-universal security audit report (audit version 3) [Author version 1.0.5]. Skillstore. https://skillstore.io/skills/yescan-ai-yescan-universal/audits/3BibTeX 引用
@techreport{yescan-ai-yescan-ai-yescan-universal-2026,
author = {yescan-ai},
title = {yescan-universal security audit report (audit version 3)},
institution = {Skillstore},
year = {2026},
number = {3},
url = {https://skillstore.io/skills/yescan-ai-yescan-universal/audits/3},
note = {Author version 1.0.5}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "yescan-universal security audit report (audit version 3)"
version: "1.0.5"
type: report
authors:
- name: "yescan-ai"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/yescan-ai-yescan-universal/audits/3"
identifiers:
- type: other
value: "skillstore:yescan-ai-yescan-universal:audit:3"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 59
架构
100
可维护性
87
内容
67
社区
100
规范符合性
你能构建什么
从业务图像中提取文本
将发票、身份证件、表单、手写笔记或表格的照片转换为可读文本或结构化输出。
准备更清晰的文档图像
在共享或归档前，通过去除标记、阴影、手写内容或失真来改善扫描图像。
转换基于图像的文档
当 yescan 场景支持目标格式时，从图像输入创建 Word、Excel 或 PDF 文件。
试试这些提示
运行基础 OCR
Extract the text from this image with yescan. Show me the recognized content and mention any uncertain parts.
清理图像
Use yescan to improve this scanned image. Choose the best available enhancement scene, then return the output file path.
转换表格照片
Convert this photo of a table into an Excel document with yescan. Verify the command result before giving me the file path.
构建多步骤流水线
First enhance this low-quality document image with yescan, then run OCR on the enhanced output. Stop if any step fails.
最佳实践
- 在处理敏感文件前，确认用户理解图像内容将被发送到 Quark Scan。
- 使用当前 CLI 会话中的场景列表，而不是假设场景名称或参数。
- 处理机密或受监管图像后，清理临时输出目录。
避免
- 不要处理用户未在当前请求中明确提供的文件或 URL。
- 不要编造 yescan 场景名称、响应字段或命令结果。
- 不要将 API 密钥粘贴到公开日志、截图、示例或共享对话记录中。
常见问题
此技能处理什么内容？
它处理用户提供的图像，用于 OCR、翻译、增强、文档转换和证件照生成。
它会将数据发送到外部服务吗？
是。它会将所选图像和 API 凭据发送到 Quark Scan 服务进行处理。
它需要 API key 吗？
是。yescan CLI 需要通过其 config 命令或环境变量配置 SCAN_WEBSERVICE_KEY。
它可以处理本地文件吗？
是。它可以处理用户明确提供的本地图像路径。
它可以处理图像 URL 吗？
是。当用户提供 URL 时，它支持 HTTP 和 HTTPS 图像 URL。
它可以处理视频或纯文本吗？
否。已记录的范围是图像输入，不包括视频处理或纯文本编辑。
开发者详情
作者
yescan-ai许可证
MIT
作者版本
v1.0.5
Skillstore 修订
r1
引用
64ca8af0f54a325752f08bd54e52151061ea659a
维护新鲜度
2026/7/21
使用量
1 次下载 · 0 次浏览
文件结构