GLM-OCR-Formula
Analysis
This skill is coherent for formula OCR, but it requires a ZhiPu API key and sends chosen images or PDFs to the external GLM-OCR API.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
ONLY use GLM-OCR API ... NEVER offer alternatives ... IF API fails — Display the error message and STOP immediately
The skill strongly constrains the agent to use this specific OCR API and not attempt fallback extraction methods. This is disclosed and aligned with an API-specific OCR skill, but it affects how the agent handles failures or alternatives.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
api_key = _get_env("ZHIPU_API_KEY") ... headers = {"Authorization": f"Bearer {api_key}"The script uses a ZhiPu API key as a bearer credential for the official API request. This is expected for the service integration and there is no evidence of hardcoding, logging, or sending the key to an unrelated endpoint.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
data = path.read_bytes(); b64 = base64.b64encode(data) ... requests.post(api_url, json=payload, headers=headers
For local files, the script reads the selected file, base64-encodes it, and submits it to the external GLM-OCR API endpoint. This is central to the skill's purpose and disclosed, but it means file contents leave the local environment.