Enterprise Qualification Ocr
v1.0.4将图片中的文字、营业执照、社会团体法人登记证书、工会法人资格证书、宗教活动场所登记证、民办非企业单位登记证书、事业单位法人证书、统一社会信用代码证书等信息识别并提取出来。本技能应在用户需要 OCR 识别图片中的文字，或识别营业执照、社会团体法人登记证书、工会法人资格证书、宗教活动场所登记证、民办非企业单位登记证书...
⭐ 0· 104·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (enterprise OCR for business/qualification documents) matches its code and instructions: it reads a local image and posts it to the Scnet OCR endpoint. The single external service (api.scnet.cn) and a single API key are appropriate for the stated purpose. One mismatch: the registry metadata lists no required environment variables, but the SKILL.md and code require/configure a SCNET_API_KEY (via config/.env).
Instruction Scope
SKILL.md and scripts/main.py limit actions to reading a local file path, reading config/.env, and POSTing the file to the Scnet OCR API. The docs suggest an environment-variable option for SCNET_API_KEY, but the implemented loader only reads config/.env (the script's error messages mention export as an alternative). The skill outputs JSON to stdout and does not reference other system files or external endpoints beyond the Scnet API.
Install Mechanism
No install spec is provided (instruction-only plus a Python script). Dependencies are minimal (Python 3 and requests). No downloaded code from arbitrary URLs, no archives extracted, and no system-level installers are invoked.
Credentials
The skill legitimately requires one API credential (SCNET_API_KEY) for the Scnet service — this is proportionate. However, the skill metadata did not declare required env vars while SKILL.md and the script clearly require SCNET_API_KEY in config/.env; this mismatch should be corrected or verified before installation.
Persistence & Privilege
The skill does not request permanent presence (always is false), does not modify other skills or system-wide settings, and does not write files except optionally reading a config file in its own config/.env path. No elevated or persistent privileges are requested.
Assessment
This package appears to do only what it claims: upload a local image to https://api.scnet.cn/api/llm/v1/ocr/recognize using a SCNET_API_KEY. Before installing, do the following: (1) Verify you trust the Scnet service and its privacy policy (you will send document images to that endpoint). (2) Create the config/.env file with SCNET_API_KEY and set file permissions (600) as instructed — do NOT paste your API key into chats. (3) Note the minor inconsistencies: the skill registry metadata doesn't declare the required env var and the README mentions environment-variable configuration while the loader reads config/.env; confirm which method you prefer and, if you rely on environment variables, consider modifying the script to read them. (4) Review network policies and rate limits (10 QPS) if you will process many images. If you need stronger guarantees about data handling, ask the maintainer for a privacy/data-retention statement or run OCR locally with an alternative tool.Like a lobster shell, security has layers — review code before you run it.
latestvk97c507vz0mhth121ycxp58dbn84ytk5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.