Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ocr Scanner Image
v1.0.1Perform OCR on image files (jpg, png, bmp, gif, tiff) using the system's `tesseract` binary and return extracted plain text.
⭐ 0· 103·0 current·1 all-time
by@kaarl92
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The stated purpose is local OCR via the system tesseract binary and the provided ocr.sh wrapper implements that (and also PDF→PNG conversion via pdftoppm). However, the package also contains scripts/example.py which uses the external ocr.space API (network call) and a demo API key; that behavior is not described in SKILL.md and is not necessary for the stated local-tesseract purpose.
Instruction Scope
SKILL.md instructs the agent/user to run the included bash wrapper (ocr.sh) which operates locally and prints output to stdout. It does not mention uploading files to external services. The presence of example.py that will POST local files to a remote OCR API means there is code in the skill that would transmit image contents off-host—this is out-of-band relative to the SKILL.md guidance and is a potential privacy/exfiltration risk if run without understanding.
Install Mechanism
There is no install spec (instruction-only), which minimizes installation risk. The skill ships scripts that will run from disk, but nothing is downloaded or installed automatically.
Credentials
The skill requests no environment variables or credentials. The example Python script embeds a public demo API key ('helloworld') which is not secret but does cause local files to be uploaded to a third-party service if used. Also, SKILL.md and scripts implicitly require system binaries (tesseract, pdftoppm, possibly pdftoppm/png conversion tools) even though the registry metadata lists none—this omission is a proportionality/information gap to be aware of.
Persistence & Privilege
The skill is not always-enabled, does not request elevated or persistent agent privileges, and only suggests an optional shell alias (editing ~/.bashrc) if the user chooses to do so.
What to consider before installing
This skill's primary wrapper (scripts/ocr.sh) performs local OCR using tesseract and is consistent with the description—use this if you want offline processing. Before installing or running: (1) Ensure you have tesseract and pdftoppm (or equivalent) installed—the SKILL metadata does not declare these but the scripts depend on them. (2) Inspect and avoid running scripts/example.py on sensitive images: it uploads files to the external ocr.space API using a public demo key, which will transmit your image contents off-host. (3) If you only want local OCR, delete or ignore example.py and run ocr.sh directly. (4) Be cautious about adding the optional alias to your shell config—it's safe but modifies your shell environment. If you want more assurance, ask the skill author to (a) declare required binaries in metadata, (b) remove or clearly document the network-upload example, or (c) provide a pure-local example only.Like a lobster shell, security has layers — review code before you run it.
latestvk97afkcq098tvh22b7wpcdttg5838hyk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.