Baidu Ocr

百度 OCR 文字识别。支持中英文混合、公式、表格识别，准确率 95%+。使用百度 AI 开放平台 API。

Security Scan

The skill's purpose (Baidu OCR) is plausible, but the package contains hard-coded Baidu API credentials and the runtime instructions ask you to set your own credentials — a mismatch that could cause your images to be sent using the publisher's account and quota.

Purpose & Capability

Name/description, required binaries (python3), and requested env vars (BAIDU_API_KEY, BAIDU_SECRET_KEY) match an OCR integration. However the shipped Python script embeds a different API_KEY/SECRET_KEY pair and does not read environment variables — the credential requirements in metadata/SKILL.md are thus inconsistent with the actual code.

Instruction Scope

SKILL.md instructs the agent/user to set BAIDU_API_KEY and BAIDU_SECRET_KEY and to run the bundled script. The script, however, ignores env/config and uses hard-coded credentials to call Baidu's OCR endpoints, meaning images provided to the skill will be uploaded under the included account rather than the user's. Instructions otherwise stay within OCR purpose and use legitimate Baidu endpoints.

Install Mechanism

No external install/downloads or third-party URLs — the skill is instruction-only with a local Python script. This low install footprint reduces supply-chain risk. Metadata lists dependencies (requests, Pillow); the script imports requests but not Pillow (minor inconsistency).

Credentials

The skill declares BAIDU_API_KEY and BAIDU_SECRET_KEY as required—which is appropriate for an OCR integration—but the code bypasses these and uses embedded credentials. That is disproportionate and suspicious because it removes the need for the user's keys and routes data through the publisher's account.

Persistence & Privilege

No 'always: true', no install-time changes to system or other skills, and the skill does not request elevated system privileges. It only requires running a Python script on demand.

What to consider before installing

Do not run this skill as-is on sensitive images. The included baidu_ocr.py contains hard-coded BAIDU API credentials (visible in the file and referenced in the activation guide), while SKILL.md tells you to set your own credentials — this mismatch means your images will likely be uploaded using the publisher's Baidu account (potential privacy, quota, and billing concerns). Before installing or running: 1) Inspect baidu_ocr.py and remove the embedded API_KEY/SECRET_KEY or replace them with code that reads BAIDU_API_KEY and BAIDU_SECRET_KEY from the environment/config. 2) Confirm the code prioritizes environment variables over any hard-coded defaults. 3) Optionally, run the script in an isolated environment or sandbox and monitor network calls to verify destination endpoints. 4) If you cannot or will not modify the code, consider rejecting the skill or asking the publisher why their credentials are embedded and whether they intend to collect images. If you previously used the embedded key unintentionally, consider contacting Baidu or rotating/revoking keys associated with your own account and review any sensitive data that may have been sent. Additional info that would change this assessment: if the maintainer publishes an updated version that removes hard-coded credentials and clearly documents that only the user's API keys are used, the concern would be resolved.

百度 OCR

使用百度 AI 开放平台进行高精度文字识别。

特点

• ✅ 中英文混合识别
• ✅ 准确率 95%+
• ✅ 支持公式识别
• ✅ 支持表格识别
• ✅ 每天 500 次免费额度

快速开始

python3 {baseDir}/baidu_ocr.py /path/to/image.jpg

使用方法

python3 {baseDir}/baidu_ocr.py <图片路径> [输出格式]

参数:

• <图片路径>: 本地图片文件（jpg, png, bmp 等）
• [输出格式]: 可选，text（默认）或 json

示例

# 基础识别
python3 {baseDir}/baidu_ocr.py image.jpg

# JSON 格式输出
python3 {baseDir}/baidu_ocr.py image.jpg json

# 批量处理
for file in *.jpg; do
    python3 {baseDir}/baidu_ocr.py "$file"
done

API 配置

在 ~/.openclaw-env 中配置：

export BAIDU_API_KEY="your_api_key"
export BAIDU_SECRET_KEY="your_secret_key"

或者在 ~/.openclaw/openclaw.json 中配置：

{
  skills: {
    "baidu-ocr": {
      apiKey: "YOUR_API_KEY",
      secretKey: "YOUR_SECRET_KEY"
    }
  }
}

支持的图片格式

• JPG/JPEG
• PNG
• BMP
• WEBP
• GIF

识别类型

类型	说明	API
通用文字	中英文混合识别	general_basic
高精度	含位置信息	general
表格	表格结构识别	table
公式	数学公式识别	formula

免费额度

• 通用文字识别: 每天 500 次
• 高精度版: 每天 50 次
• 表格识别: 每月 500 次
• 公式识别: 每月 500 次

错误处理

错误码	说明	解决方法
110	Access Token 无效	重新获取 Token
111	Access Token 过期	重新获取 Token
216100	认证失败	检查 API Key
216101	授权失败	检查 Secret Key

相关文档

• 百度 OCR 官方文档
• API 调用说明

---

版本：1.0.0 | 更新时间：2026-03-07