海运托书智能提取 Shipping Booking Extractor
v1.0.6海运托书（Booking Note / Shipping Instruction）智能提取工具。从 PDF、图片、扫描件、Word、Excel、RTF 等格式的托书文件中提取结构化信息，输出标准 JSON。当用户明确提到"托书"、"booking"、"shipping instruction"、"帮我提取"、"解...
⭐ 1· 100·0 current·0 all-time
byBruce@brucezhouzhou
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description match the included script and docs: it extracts text/images from PDFs, Word, Excel, RTF and calls an LLM/vision provider to produce JSON. The primary credential (Anthropic) and optional OpenAI-compatible keys are appropriate for that purpose. Minor metadata inconsistency: top-level 'Required env vars: none' vs SKILL.md metadata which declares it requires either ANTHROPIC_API_KEY or OPENAI_API_KEY.
Instruction Scope
Runtime instructions are narrowly scoped: run the provided extract.py on an uploaded file. The script reads/convert the given file(s), may call local helpers (textutil / libreoffice) for .doc/.rtf, encodes images as base64, and sends content to configured model endpoints. It does not instruct reading unrelated system files or credentials beyond the declared API keys. It will transmit the document contents as part of API requests (as described in the SKILL.md).
Install Mechanism
No opaque network install steps are present. Dependencies are standard Python packages listed in requirements.txt (anthropic, openai, pdfplumber, pymupdf, python-docx, openpyxl, xlrd, striprtf). The recommended pip install is proportionate to the document-processing goal; there are no downloads from arbitrary URLs or archive extraction operations in the manifest.
Credentials
Requested credentials align with functionality: ANTHROPIC_API_KEY is primary, and OPENAI_API_KEY is offered as an alternative to call OpenAI-compatible endpoints. The SKILL.md also references OPENAI_BASE_URL and optional SHIPPING_MODEL/SHIPPING_VISION_MODEL env vars for configuration — these are reasonable but should be noted. No unrelated secrets or system credentials are requested. There is a small inconsistency between registry 'Required env vars: none' and SKILL.md's declared anyEnv (ANTHROPIC_API_KEY or OPENAI_API_KEY).
Persistence & Privilege
The skill is not forced-always, and does not request elevated or persistent platform privileges. It runs as an on-demand script, may invoke local binaries (textutil/libreoffice) for format conversion, and writes temporary files during conversion — behavior consistent with its purpose.
Assessment
This skill appears to do what it says: it converts uploaded booking documents to text/images and sends them to the configured AI model(s) to extract JSON. Before installing, consider:
- Data exposure: uploaded documents (text and embedded images) are included in API requests to third‑party model endpoints (Anthropic/OpenAI/etc.). If files contain sensitive commercial or personal data, restrict use or choose an on-prem / privacy-preserving model.
- API key placement: the skill expects ANTHROPIC_API_KEY or OPENAI_API_KEY (and optionally OPENAI_BASE_URL or SHIPPING_MODEL/SHIPPING_VISION_MODEL). Verify where OpenClaw stores these keys and limit their scope/permissions where possible.
- Local binaries: the script may call textutil (macOS) or libreoffice (headless) for .doc/.rtf conversion; ensure these tools are trusted and available if you need those formats.
- Test with non-sensitive files first to confirm behavior.
Also note the minor manifest inconsistency: the top-level metadata says no required env vars while the SKILL.md and script expect an LLM API key; this is likely harmless but you should ensure you provide the intended key before use.Like a lobster shell, security has layers — review code before you run it.
latestvk979k0xc7t3q5r15hj8676m1rx83zq7g
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🚢 Clawdis
Primary envANTHROPIC_API_KEY