发票识别（invoice-ocr-xy）翔云平台

• Verdict: Advisory
• Analyzed: Apr 15, 2026, 9:31 AM
• Findings: 0
• Version: 2.0.0
• Hash: b8554ad8c54ba66f78cae6d98efe34eb2af33d81d36c4fbf482e96d8d5b91a46
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: invoice-ocr-xy Version: 2.0.0 The skill provides legitimate invoice OCR functionality using the Xiangyun (netocr.com) API. The main script `scripts/recognize_invoices.py` handles file scanning, multipart API requests via `urllib`, and result exportation to Excel or JSON. It includes a helper function to auto-install the `openpyxl` library using `subprocess`, which is hardcoded and limited to that specific package. The `SKILL.md` instructions correctly guide the AI agent to request necessary API credentials from the user for local storage in `config.json`. No evidence of data exfiltration to unauthorized endpoints or malicious execution was found.