Aguara Watch

openocr-skill

clawhub:openocr-skill

View source
A
100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

6

Score

100/100

LOW 6

Findings (6)

LOW
pip install arbitrary package
L608

Detects pip install of arbitrary packages that modify the host environment

pip install op
FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.

LOW
pip install arbitrary package
L611

Detects pip install of arbitrary packages that modify the host environment

pip install op
FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.

LOW
pip install arbitrary package
L614

Detects pip install of arbitrary packages that modify the host environment

pip install op
FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.

LOW
pip install arbitrary package
L617

Detects pip install of arbitrary packages that modify the host environment

pip install op
FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.

LOW
pip install arbitrary package
L620

Detects pip install of arbitrary packages that modify the host environment

pip install op
FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.

LOW
Git clone and execute chain
L623

Detects git clone of repositories followed by execution of cloned content

git clone https://github.com/Topdu/OpenOCR.git + pip install .
FIX

Review the dependency tree for nested or transitive dependencies that introduce risk. Use tools like npm audit or pip-audit to identify known vulnerabilities in the dependency chain.

FP?

Likely FP if the flagged dependency is a standard, widely-used library with no known vulnerabilities at the time of scanning.