ifly-ocr-invoice

This skill implements iFlytek invoice OCR and the code matches that purpose, but there are a few red flags you should consider before installing: - The registry metadata incorrectly lists no required environment variables, yet both SKILL.md and the script require XFYUN_APP_ID, XFYUN_API_KEY, and XFYUN_API_SECRET. Treat the SKILL.md as authoritative and provide those credentials only if you trust the skill/source. - Avoid running the SKILL.md's debug echo command that prints the full values of your credentials — doing so can leak secrets into terminal history, CI logs, or agent transcripts. Instead, verify env vars exist without printing their values (for example, test presence by checking non-empty length in a safe script). - The script constructs an authorization parameter (base64 including api_key) and appends it to the URL query; this can appear in logs and URL traces. Prefer running it in an environment where network traffic and logs are not publicly exposed. - .claude/settings.local.json grants WebFetch to console.xfyun.cn but the API endpoint used is api.xf-yun.com — confirm that network permissions will allow requests to api.xf-yun.com or update allowed domains as needed. - If you proceed, run the script in an isolated environment, keep credentials in a secure secrets store (not plain shell history), and review the script source yourself. If you cannot verify the publisher or prefer not to expose API credentials, do not install or run this skill.