RapidOCR

Extract text from local image files with RapidOCR. Use when the user wants OCR on a JPG, PNG, WEBP, BMP, or TIFF image and may want plain text or JSON output.

Security Scan

The skill's requirements and instructions match its stated purpose (local OCR via a Node wrapper that calls a Python RapidOCR library); it reads local files only and does not request unrelated credentials or remote endpoints.

Purpose & Capability

Name/description, required binaries (node + a Python interpreter), and included files (JS wrapper + Python entrypoint) align with a local OCR wrapper that calls the RapidOCR Python library. The skill asks users to pip install 'rapidocr' and 'onnxruntime', which is consistent with the declared functionality.

Instruction Scope

The SKILL.md and wrapper focus on extracting a local image path and running the Python OCR engine. The wrapper enforces file-extension checks and existence (fs.existsSync) and explicitly forbids remote URLs and PDFs. Minor note: the wrapper will inspect a number of environment variables (SKILL_ARGS, SKILL_INPUT, SKILL_USER_PROMPT, INPUT, USER_PROMPT, ARGS, ARGUMENTS, PROMPT) and parse JSON-like input to find a local path. That behavior is coherent with its goal of locating a path from different input forms, but the SKILL metadata did not declare these env sources; users should be aware the wrapper reads them to extract the image path.

Install Mechanism

There is no install spec (instruction-only install), which is low-risk. The skill includes local code files (JS + Python) and instructs the user to install Python packages (rapidocr, onnxruntime) into their chosen interpreter. No downloads from external ad-hoc URLs or archive extraction are present.

Credentials

The skill does not request or require secrets/credentials. It does, however, read several environment variables as input sources and supports an override RAPIDOCR_PYTHON to choose the interpreter. These env vars are used only to find an image path or the Python binary and are not used to access unrelated credentials. Users should consider whether any of those env variables in their environment contain sensitive data (e.g., a prompt or path they don't want used).

Persistence & Privilege

The skill is not always-enabled, is user-invocable, and does not request persistent platform privileges or modify other skills. It runs as a wrapper that spawns a local Python process; there is no evidence it modifies system or agent-wide configuration.

Assessment

This skill appears to be what it says: a local OCR wrapper that runs a Python RapidOCR engine. Before installing, verify you are comfortable installing the Python packages (rapidocr, onnxruntime) into your environment. Note the wrapper will search several environment variables (SKILL_* and common prompt/args names) and any JSON-like input for a local file path — that is by design to find an image path, but if you have sensitive values in those env vars you may want to clear them or run the skill in a clean environment. The wrapper only operates on existing local image files (it checks file extensions and existence) and does not include remote network calls or credential exfiltration. If you need stronger guarantees, review the included run_rapidocr.js and run_rapidocr.py code locally before use and run the skill in a restricted environment (container or isolated account) when trying it for the first time.

ClawHub skill for local image OCR with RapidOCR.

When to use

• The user wants text extracted from a local image file.
• The input is a local png, jpg, jpeg, webp, bmp, tif, or tiff file.
• The user wants either plain text output or structured JSON output.

Do not use

• Remote image URLs.
• PDF OCR.
• Relative paths when an absolute path is available.

Execution

1. Pass the user's original request directly to the wrapper script.
2. Run node "{baseDir}/run_rapidocr.js" "{{input}}".
3. If the host does not substitute {baseDir}, resolve the directory containing this SKILL.md and run the sibling file run_rapidocr.js from there.
4. For local testing, RAPIDOCR_PYTHON=/path/to/python can be used to force a specific interpreter.
5. Otherwise the wrapper auto-discovers python3, python, or py.
6. If the user asks for JSON, preserve the script's JSON output exactly.
7. If dependencies are missing, tell the user to run <python> -m pip install rapidocr onnxruntime with the interpreter they intend to use.
8. Publish this folder to ClawHub with slug rapidocr.

Behavior

• The wrapper extracts a local image path from natural language, JSON-like input, or a direct path.
• The wrapper only reads existing local image files.
• Default output is plain text, one recognized line per line.
• JSON mode returns text, lines, boxes, scores, and source.