pdf-ocr

支持双引擎的PDF OCR识别技能，可从影印版PDF文件和图片文件中提取文字内容

This skill appears to implement the advertised OCR functionality, but review these before installing: - The registry metadata omits required env vars but SKILL.md/.env expect SILICON_FLOW_API_KEY for the cloud engine — treat the cloud engine as requiring a secret key. - The code will auto-install Python packages with pip at runtime (subprocess pip install). That can change your environment and pull code from PyPI; prefer installing dependencies yourself in a virtualenv or review required packages and versions first. - If you enable the cloud engine, the skill uploads full images (base64) to https://api.siliconflow.cn — do not use the cloud engine for sensitive documents unless you trust the service and the API key handling. Consider running RapidOCR (local) only for private data. - Verify the vendor/source (homepage is missing and source is 'unknown'). If you need to trust this skill long-term, obtain it from a known repository or author, inspect the full code (including the truncated parts) and test in a sandbox environment. If you want to proceed safely: run the skill in an isolated environment (virtualenv/container), manually install and pin dependencies from requirements.txt, avoid configuring the cloud API key unless necessary, and audit network calls/logging to ensure no unexpected endpoints receive your data.

Type: OpenClaw Skill Name: pdf-ocr-skill Version: 2.2.0 The skill bundle contains a high-risk behavior in `scripts/pdf_ocr_processor.py`, where it defines an `install_dependency` function that uses `subprocess.check_call` to automatically execute `pip install` for missing libraries at runtime. While the currently hardcoded packages (rapidocr_onnxruntime, pymupdf, pillow) are legitimate, this pattern of auto-installing dependencies is a common vector for supply chain risks and unauthorized code execution. The rest of the bundle, including the prompt instructions in `SKILL.md` and the integration with the SiliconFlow API (api.siliconflow.cn), appears consistent with its stated purpose as an OCR utility.