Bizcard
v0.1.2Business card scanner + Google Contacts manager. Auto-detects business card images, extracts contact info via OCR (imageModel), confirms with user, saves to...
⭐ 0· 479·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (business card OCR → Google Contacts) match the declared environment needs: MATON_API_KEY (gateway for Google Contacts) and NANO_BANANA_API_KEY (image correction). The described pipeline (OCR, parsing, formatting, dedupe, upload) is coherent with those credentials.
Instruction Scope
SKILL.md instructs the agent to: send images to an imageModel (Gemini Flash) for OCR, call Maton gateway endpoints (using MATON_API_KEY) to search/create contacts, call an external image-correction service (Nano Banana), run ImageMagick commands and temporary-file shell commands, and present a fixed user-confirmation template. All actions are within the stated purpose, but the instructions perform file I/O, shell execution, and network calls to third-party services — review and consent are important.
Install Mechanism
This is instruction-only (no install spec), which reduces supply-chain risk, but SKILL.md and README require local binaries (ImageMagick 'magick', python3, mktemp) while the registry metadata lists 'Required binaries: none'. The README suggests installing ImageMagick but the registry does not declare it. That mismatch is an incoherence that could surprise users or cause runtime failures.
Credentials
The two required env vars (MATON_API_KEY, NANO_BANANA_API_KEY) correspond to services used by the pipeline. The skill does not ask for unrelated secrets. Note: Telegram bot tokens and Maton OAuth for Google Contacts are referenced in README/Quick Start but are not listed as required env vars in the registry metadata — they are configuration the user must supply outside the skill.
Persistence & Privilege
always:false and no install spec mean the skill does not request forced persistent inclusion. The skill instructs users to optionally add environment variables to system launch agents and to configure a dedicated bot/workspace (user-driven). The skill does not attempt to modify other skills or system-wide agent settings on its own.
Assessment
This skill appears to do what it says: OCR a business card, normalize and format fields, deduplicate, then create/update Google Contacts via a gateway. Before installing: 1) Confirm you trust the external services (Maton gateway, Nano Banana, and the image model) and understand what MATON_API_KEY / NANO_BANANA_API_KEY permit (Maton will be used to access Google Contacts on your behalf). 2) Be aware the skill runs shell commands (ImageMagick) and Python snippets that read/write /tmp; ensure you have ImageMagick and python3 installed — the registry metadata does not declare these binaries (mismatch). 3) Prefer running the skill in a dedicated workspace and bot account as suggested, and review the SKILL.md/README so you are comfortable with the exact confirmation template and automatic contact-creation flow. 4) If you need higher assurance, ask the author for concrete Nano Banana API call examples and a declared list of required binaries and scopes for MATON_API_KEY (OAuth scopes) before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk972hhg85v5casy2hgp7bkd9rh81h4x4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📇 Clawdis
EnvMATON_API_KEY, NANO_BANANA_API_KEY