GLM-OCR-Table
Analysis
The skill is coherent for table OCR using the ZhiPu GLM-OCR API, but users should notice that local documents may be uploaded to an external service using their API key.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
ONLY use GLM-OCR API ... NEVER parse tables yourself ... NEVER offer alternatives ... NO fallback methods
The skill gives forceful instructions that constrain the agent to this API-based workflow and discourage alternatives.
pip install requests\nOr install all dependencies: pip install -r requirements.txt
The script depends on an external Python package and suggests manual pip installation if it is missing.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
api_key = _get_env("ZHIPU_API_KEY") ... headers = {"Authorization": f"Bearer {api_key}"The script reads a ZhiPu API key from the environment and uses it as a bearer credential for API calls.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
data = path.read_bytes() ... return f"data:{mime};base64,{b64}" ... requests.post(api_url, json=payload, headers=headers, timeout=timeout)For local files, the script reads the file, base64-encodes it, and sends it in a JSON request to the OCR API.