Security checks across malware telemetry and agentic risk
DocPilot appears to be a legitimate document-processing skill, but it uploads user documents to a configurable remote API without clear enough privacy disclosure or destination safeguards.
Review before installing. Use this only with documents you are allowed to send to DocPilot or another configured endpoint, verify config.json and environment settings before use, replace or remove the bundled api_key value, and avoid confidential or regulated documents unless the provider and endpoint meet your data-handling requirements.
if md_return_image:
data["md_image_format"] = md_image_format
response = requests.post(api_url, headers=headers, files=files, data=data, timeout=120)
if response.status_code == 200:
result = response.json()if options:
data["options"] = json.dumps(options) if isinstance(options, dict) else options
response = requests.post(api_url, headers=headers, files=files, data=data, timeout=120)
if response.status_code == 200:
result = response.json()if category_schema:
data["category_schema"] = json.dumps(category_schema) if isinstance(category_schema, dict) else category_schema
response = requests.post(api_url, headers=headers, files=files, data=data, timeout=120)
if response.status_code == 200:
result = response.json()64/64 vendors flagged this skill as clean.