PaddleOCR Document Parsing
v2.0.16Use this skill to extract structured Markdown/JSON from PDFs and document images—tables with cell-level precision, formulas as LaTeX, figures, seals, charts,...
⭐ 42· 7.7k·54 current·57 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, scripts, and declared env vars (PADDLEOCR_DOC_PARSING_API_URL and PADDLEOCR_ACCESS_TOKEN) align: the code posts documents to a PaddleOCR layout-parsing endpoint and returns structured JSON/Markdown. Required binary 'uv' is used to run the scripts and is appropriate for this packaging model.
Instruction Scope
Runtime instructions focus on invoking the included CLI scripts and only reference the declared env vars. The skill saves full raw JSON results to a temp directory by default and instructs the agent to read/return the complete output — this is expected for a parser but means sensitive document contents will be written to disk and may be returned to users. The scripts do not attempt to read unrelated system files or credentials.
Install Mechanism
There is no explicit install spec; the skill expects 'uv' to run scripts which will automatically resolve dependencies (httpx, Pillow, pypdfium2) from package sources. This is consistent with the skill's design but implies standard supply-chain risk (dependencies are fetched at run time from registries).
Credentials
Only the API URL and access token are required and the primaryEnv is appropriately the access token. One optional env var (PADDLEOCR_DOC_PARSING_TIMEOUT) is referenced in code and documentation but not listed in the required env metadata — minor mismatch but not malicious. No unrelated credentials or broad system secrets are requested.
Persistence & Privilege
The skill does not request permanent inclusion (always=false) and does not modify other skills or system-wide settings. It writes result JSON into the skill-scoped temp path by default; this is expected but worth noting for privacy reasons.
Assessment
This skill appears to do what it claims, but consider these practical precautions before installing or running it: (1) You must provide a PADDLEOCR_DOC_PARSING_API_URL and PADDLEOCR_ACCESS_TOKEN — the skill will upload files (base64 for local file inputs) to that endpoint, so only use tokens/endpoints you trust. (2) By default results are auto-saved under the system temp directory (containing full extracted text and potentially sensitive data); use --stdout or a controlled --output path if you want to avoid leftover temp files. (3) The runner 'uv' will fetch dependencies (httpx, Pillow, pypdfium2) at runtime — standard PyPI supply-chain risks apply. (4) There is a minor metadata mismatch: an optional env var PADDLEOCR_DOC_PARSING_TIMEOUT is used but not declared as required; set it if you need different network timeouts. (5) If you will parse private/local files, be deliberate about using file-path (uploads content) vs file-url (service fetches URL) depending on privacy requirements.Like a lobster shell, security has layers — review code before you run it.
latestvk97cpmwcfg3g9efv6rvf7kad898446p9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📄 Clawdis
Binsuv
EnvPADDLEOCR_DOC_PARSING_API_URL, PADDLEOCR_ACCESS_TOKEN
Primary envPADDLEOCR_ACCESS_TOKEN