LLMWhisperer

Extract text and layout from images and PDFs using LLMWhisperer API. Good for handwriting and complex forms.

Security Scan

The skill's runtime instructions largely match its stated purpose (upload a file to an OCR API), but the package metadata omits the config/env requirements and references a script path that isn't present — these inconsistencies warrant caution before installing or trusting it with sensitive documents.

Purpose & Capability

The SKILL.md and the inline script perform exactly what the description says: POST the provided file to an LLMWhisperer OCR endpoint and return the result. The external endpoints in the script (unstract.com / llmwhisperer-api.us-central.unstract.com) match the documentation links in the README. However the skill's registry metadata lacks a homepage/source URL despite the SKILL.md referencing unstract — that's a minor provenance gap.

Instruction Scope

Instructions are focused: they read an API key from ~/.clawdbot/.env (or the environment) and upload the specified file. The script does not attempt to read other system paths or other credentials. Two points to note: (1) the SKILL.md claims an executable at scripts/llmwhisperer but no such file exists in the package (the script is only embedded in the doc), and (2) the script uses export $(grep ... | xargs) to load the key, which is a common pattern but can mis-handle unusual .env lines (word-splitting) — not an obvious exfiltration vector, but brittle.

Install Mechanism

There is no install spec (instruction-only), so nothing is written to disk by a package installer. This is lower risk. The only install-like action is the README telling the user how to append the API key to ~/.clawdbot/.env. The missing scripts/ path noted above is an inconsistency but not an installer risk by itself.

Credentials

The skill requires a single service credential (LLMWHISPERER_API_KEY) which is appropriate for a third‑party OCR API. However the registry metadata declares no required env vars or config paths while the SKILL.md explicitly requires LLMWHISPERER_API_KEY and the ~/.clawdbot/.env file — this mismatch is an incoherence in the manifest and should be corrected. Also note: the skill will upload any file you pass to an external, third‑party API; that is expected for this purpose but is a privacy/security consideration for sensitive documents.

Persistence & Privilege

The skill is not marked always:true and does not request persistent system-level privileges. It is user-invocable and can be invoked autonomously (default), which is normal for skills; there are no other privilege escalation indicators in the manifest or instructions.

What to consider before installing

This skill appears to do what it says (send a file to the LLMWhisperer API to extract text/layout), but there are some inconsistencies you should address before installing or using it with sensitive data: - Manifest mismatch: The registry entry claims no required env vars or config paths, but SKILL.md requires LLMWHISPERER_API_KEY stored in ~/.clawdbot/.env. Ask the publisher to update the manifest to declare the required env var and config path. - Missing script file: SKILL.md references scripts/llmwhisperer but the package contains only SKILL.md. Confirm how the script will be installed or executed by your platform. - Data privacy: Using the skill uploads your file to a third‑party API (llmwhisperer-api.us-central.unstract.com). Do not upload sensitive or regulated documents unless you trust the service and have reviewed its privacy/security policy and TLS/certificate validity. - Minor robustness: The inline export-loading command is brittle (word-splitting) but not obviously malicious. If you use the skill, prefer setting LLMWHISPERER_API_KEY in your environment rather than relying on parsing a shared .env file. If you cannot verify the vendor (unstract) or do not trust sending documents off-host, consider running an offline OCR alternative instead. If you want, I can draft a message to the skill owner asking them to fix the manifest and include the script file.

Extract text from images and PDFs using the LLMWhisperer API — great for handwriting and complex forms.

Configuration

Requires LLMWHISPERER_API_KEY in ~/.clawdbot/.env:

echo "LLMWHISPERER_API_KEY=your_key_here" >> ~/.clawdbot/.env

Get an API Key

Get a free API key at unstract.com/llmwhisperer.

• Free Tier: 100 pages/day

Usage

llmwhisperer <file>

Script Source

The executable script is located at scripts/llmwhisperer.

#!/bin/bash
# Extract text using LLMWhisperer API

if [ -z "$LLMWHISPERER_API_KEY" ]; then
  if [ -f ~/.clawdbot/.env ]; then
    # shellcheck disable=SC2046
    export $(grep -v '^#' ~/.clawdbot/.env | grep 'LLMWHISPERER_API_KEY' | xargs)
  fi
fi

if [ -z "$LLMWHISPERER_API_KEY" ]; then
  echo "Error: LLMWHISPERER_API_KEY not found in env or ~/.clawdbot/.env"
  exit 1
fi

FILE="$1"
if [ -z "$FILE" ]; then
  echo "Usage: $0 <file>"
  exit 1
fi

curl -s -X POST "https://llmwhisperer-api.us-central.unstract.com/api/v2/whisper?mode=high_quality&output_mode=layout_preserving" \
  -H "Content-Type: application/octet-stream" \
  -H "unstract-key: $LLMWHISPERER_API_KEY" \
  --data-binary "@$FILE"

Examples

Print text to terminal:

llmwhisperer flyer.jpg

Save output to a text file:

llmwhisperer invoice.pdf > invoice.txt

Process a handwritten note:

llmwhisperer notes.jpg