MiniMax PDF OCR

使用 MiniMax Vision API 识别 PDF/图片中的文字

This skill's code does what its name says: it converts PDF pages to images and uploads those images to a MiniMax Vision API to get OCR results, then writes a Markdown file. Before installing or using it, consider: 1) Privacy: images (full page content) are sent to https://api.minimax.chat — do not process sensitive/confidential documents unless you trust that service and its privacy policy. 2) Credentials: the code requires MINIMAX_API_KEY (set in env). The registry metadata incorrectly stated no env vars — verify you are comfortable providing that API key. 3) System dependency: pdftoppm (poppler) must be installed; SKILL.md mentions it but registry metadata omitted it. 4) Inconsistencies: SKILL.md recommends npm packages (openai, pdf2image) that are not used by the shipped code — this suggests sloppy packaging; prefer to inspect/run the script in a sandbox first. 5) Safety checks: check the API endpoint and the publisher before using with real secrets, and test on non-sensitive sample documents. If you want to proceed, run it locally in an isolated environment and verify network endpoints and outputs yourself. If you require higher assurance, ask the publisher to correct the metadata and provide provenance/hosting information.

Type: OpenClaw Skill Name: minimax-pdf-ocr Version: 1.0.0 The skill contains a potential shell injection vulnerability in `pdf-ocr-minimax.js` due to the use of `child_process.spawn` with `shell: true` on unsanitized file paths (`pdfPath`). There is also a discrepancy between the documentation in `SKILL.md`, which instructs users to install unused dependencies (`openai`, `pdf2image`), and the actual implementation which uses native `fetch` and system calls. While the script correctly targets the legitimate MiniMax API endpoint (`api.minimax.chat`), the insecure execution pattern poses a risk.