OkraPDF

OkraPDF — upload PDFs, read extracted content, ask questions, extract structured data, and manage collections. Covers MCP, CLI, and HTTP.

This appears to be a legitimate PDF-extraction/QA integration, but take these precautions before installing or using it: 1) Confirm the remote domain (api.okrapdf.com / okrapdf.com) is one you trust and review their privacy/TOS because uploaded PDFs will be sent to that service. 2) The SKILL.md expects an API key (OKRA_API_KEY) and tells you to store it in agent config or environment; the skill metadata did not declare this — do not paste sensitive or org-confidential documents until you verify the provider. 3) The CLI install uses npm - audit the npm package 'okrapdf' (check publisher, version history, and repository/source code) before global installation. 4) If you must proceed, create a least-privilege API key, test with non-sensitive files, and consider running the CLI in a sandboxed environment. 5) If you need higher assurance, ask the publisher for source/release links or a homepage and request that required env vars and install steps be declared in the registry metadata.

Type: OpenClaw Skill Name: okra Version: 1.0.0 The skill bundle provides comprehensive documentation and tool definitions for OkraPDF, a service for PDF extraction and analysis. It includes instructions for MCP, CLI, and HTTP interfaces, allowing an agent to upload documents, query content, and extract structured data. No evidence of malicious intent, data exfiltration, or harmful prompt injection was found; the content is entirely consistent with its stated purpose of document processing. (IOC: api.okrapdf.com)