pdf-miner

Extract text and tables from PDF files with robust support for global market data formats (currencies, percentages, units). Use when: (1) User asks to read/e...

What to consider before installing/using this skill: - Documentation mismatch: the SKILL.md both says OCR is not supported and also includes full OCR support. Treat that as poor documentation and verify behavior before trusting it with sensitive PDFs. - Data exfiltration risk: OCR sends page images (base64) to a configured vision API (default base URL: https://openrouter.ai/api/v1). If you provide an API key or a base URL, pages may be uploaded to an external service. Do not supply credentials or run auto-OCR on sensitive documents unless you trust the provider and understand their data retention/privacy. - Undeclared env vars/config: The skill expects OCR_API_KEY / OPENROUTER_API_KEY, OCR_MODEL, OCR_BASE_URL or a config.json storing a vision_api_key. These were not listed in the registry metadata; treat them as optional but required if you need OCR. Storing API keys in config.json will put secrets on disk in plain text — prefer environment variables. - If you do not want OCR behavior: either avoid installing PyMuPDF/openai and do not provide an API key, or run the script with --no-auto-ocr / avoid --ocr. Test the tool on non-sensitive PDFs first to confirm it behaves as you expect. - If you need assurance: ask the publisher why the README contradicts OCR support and request a minimal build without OCR if you only need text/tables. Review the included scripts locally to confirm endpoints and behavior before running them on confidential documents.

Type: OpenClaw Skill Name: pdf-miner Version: 1.0.2 The pdf-miner skill is a legitimate PDF extraction utility that uses pdfplumber for text/table parsing and an external vision API (via the openai library) for OCR. The code in extract_pdf.py and ocr_engine.py implements standard features like keyword search, metrics extraction, and table of contents detection without any signs of malicious intent, obfuscation, or unauthorized data exfiltration. While SKILL.md contains a minor documentation contradiction regarding OCR support, the overall bundle is well-structured, follows standard security practices for API key management (env vars/config.json), and lacks any dangerous execution patterns like shell injection or persistence mechanisms.