Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (bus ticket OCR) align with the included code and SKILL.md which call Scnet's OCR API. One inconsistency: the registry metadata at the top of the submission reported "Required env vars: none", but both SKILL.md, skill.yaml, and scripts/main.py require SCNET_API_KEY (and optionally SCNET_API_BASE). This discrepancy is likely a packaging/metadata error and should be corrected.
Instruction Scope
SKILL.md and the script limit actions to reading a local image file path supplied by the user, loading SCNET_API_KEY from env or config/.env, and POSTing the file to https://api.scnet.cn/api/llm/v1/ocr/recognize. The instructions and code do not attempt to read other system files or unrelated environment variables. Note: the skill will transmit the user-supplied image to an external API (Scnet) — this is expected for an OCR service but is a privacy consideration for sensitive images.
Install Mechanism
No install spec — the skill is instruction-only with an included Python script. Dependencies are minimal (python3, requests) and there is no remote download or archive extraction. This is low-risk from an install perspective.
Credentials
The only required credential is SCNET_API_KEY (plus optional SCNET_API_BASE). That is proportionate to the stated functionality. Again, the registry metadata incorrectly listed no required env vars while the skill actually requires SCNET_API_KEY; ensure the platform prompts for this credential before use.
Persistence & Privilege
The skill does not request permanent/always-on presence and does not modify other skills or system configuration. It runs as a normal invocable skill and only reads/writes within its own skill directory (reads config/.env if present).
Assessment
This skill will send any image file path you provide to Scnet's OCR API and requires an SCNET_API_KEY. Before installing, verify you trust the Scnet service and are comfortable sending those images off-host (do not send sensitive personal data unless you accept that). Correct the metadata mismatch: the registry should declare SCNET_API_KEY as required so the platform can surface the credential prompt. Store the API key securely (use environment variable or config/.env with permissions 600 as recommended) and never paste it into chat. If you need to keep images local, do not use this skill; consider an offline OCR alternative. Finally, note the skill's homepage entry in skill.yaml appears to be a placeholder — if provenance matters, ask the publisher for an authoritative source repository or documentation.Like a lobster shell, security has layers — review code before you run it.
latestvk975yszywv0x885b7hybj2sr3s84yrzj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.