Pic2md

Image to Markdown - extract text from images (PNG, JPG, WebP) to Markdown with OCR. Use when reading text from screenshots, photos, scanned pages, or any ima...

Security Scan

The skill's requirements and instructions match its stated purpose (OCR to Markdown via the mineru-open-api CLI); the main user risk is that images are uploaded to MinerU's cloud for processing, which is consistent with the description but has privacy implications.

Purpose & Capability

Name/description: image→Markdown OCR. Required binary: mineru-open-api. Install entries (npm/uv/go) produce the mineru-open-api binary. All requested artifacts map to the stated purpose; no unrelated credentials, binaries, or config paths are requested.

Instruction Scope

SKILL.md instructs the agent to run mineru-open-api flash-extract against local files or URLs. This is within the OCR scope, but the CLI uploads images to MinerU's cloud API — so user data (images) will be transmitted off-host. The instructions do not ask the agent to read unrelated files, environment variables, or other system state.

Install Mechanism

Install spec uses public package ecosystems (npm, uv, go install) to install mineru-open-api, which is a normal/traceable mechanism but still carries the usual supply-chain risks (npm/go packages are third-party code). No direct download-from-random-URL or archive extraction is specified.

Credentials

No environment variables, credentials, or config paths are requested. The lack of secrets is proportionate to the stated functionality. The SKILL.md claims no API key or auth is required.

Persistence & Privilege

Skill is not always-enabled and does not request elevated persistence. There is no instruction to modify other skills or system-wide settings. The skill does rely on an external CLI binary being present.

Assessment

This skill appears coherent for doing OCR via the MinerU CLI, but it uploads images to MinerU's cloud for processing. Before installing or using it: 1) Do not send sensitive or confidential images unless you trust mineru.net's privacy policy and retention practices. 2) Verify the mineru-open-api package source (npm/Go repo) and publisher identity; prefer official releases and check repository/maintainer information on the homepage https://mineru.net. 3) Install and run the CLI initially in an isolated environment (container/VM) to inspect behavior and network traffic. 4) If you need on-device/offline OCR for sensitive data, consider local OCR tools (e.g., Tesseract) instead. 5) If you want additional assurance, ask the skill author for checksums or signed releases and review the mineru-open-api repository code before trusting it.

Pic2MD - Picture to Markdown Parser

Extract text from images to Markdown using MinerU Open API. No API key required.

Quick Start

# Pic2MD - Picture to Markdown Parser
mineru-open-api flash-extract screenshot.png

# Pic2MD - Picture to Markdown Parser
mineru-open-api flash-extract https://example.com/image.png

# Pic2MD - Picture to Markdown Parser
mineru-open-api flash-extract photo.jpg -o ./output/

# Pic2MD - Picture to Markdown Parser
mineru-open-api flash-extract scan.jpg --language en

Language Rule

You MUST reply to the user in the SAME language they use. This is non-negotiable.

Capabilities

• OCR text extraction from PNG, JPG, JPEG, WebP, BMP, TIFF
• Supports both local files and URLs directly
• Language hint with --language (default: ch, use en for English)
• No API key, no signup, no authentication
• Max 10MB per image

When to Use

• User asks to "read", "extract", or "OCR" an image
• User shares a screenshot and asks what it says
• User wants text from a photo of a document or whiteboard
• User needs image content converted to Markdown

CLI Reference

Run mineru-open-api flash-extract --help for all available options.

Data Privacy

• flash-extract uploads the image to MinerU's cloud API for processing and returns the result. No account or API key is required.
• Images are processed in real-time and are not stored after extraction.
• For details, see https://mineru.net

Notes

• Output is Markdown text extracted via OCR
• For higher precision or batch processing, use mineru-open-api extract (requires auth via mineru-open-api auth)
• If the CLI cannot be installed via npm/uv/go, download it from https://mineru.net/ecosystem?tab=cli