TextIn xParse Document Parse (Safer Fork)

Parse documents into clean markdown or structured JSON via the xparse-cli. Use this skill when the user provides a PDF, image, Office file, HTML, OFD, or oth...

Security Scan

The skill's instructions match a document-parsing purpose, but metadata omits the declared dependency (xparse-cli) and the install guidance recommends executing a vendor-hosted installer script (curl | source / iex) from a non-standard host, which is disproportionate and warrants caution.

Purpose & Capability

The SKILL.md clearly depends on the xparse-cli binary and optionally on TextIn (XPARSE_APP_ID/XPARSE_SECRET_CODE) for paid features. However, registry metadata lists no required binaries, env vars, or config paths — an inconsistency that could mislead reviewers or automated gate checks.

Instruction Scope

Runtime instructions are narrowly scoped to calling xparse-cli parse, inspecting output, handling encrypted PDFs, and asking the user when credentials or passwords are required. The instructions do reference a user config file (~/.xparse-cli/config.yaml) and environment variables for credentials, which are reasonable for this tool, but those config paths/envs are not declared in the registry metadata.

Install Mechanism

There is no packaged install spec in the registry, but SKILL.md provides vendor installer commands that execute remote scripts: `source <(curl -fsSL https://dllf.intsig.net/...)` and `irm https://dllf.intsig.net/... | iex`. Running remote scripts via shell/PowerShell is high risk because it executes fetched code directly; the host is a vendor domain (dllf.intsig.net) rather than a well-known release host like GitHub Releases. The skill does suggest asking the user to inspect the script first, but inclusion of these commands in instructions is a significant install-risk indicator.

Credentials

The skill uses only service-specific credentials (XPARSE_APP_ID, XPARSE_SECRET_CODE) for paid features and the CLI stores creds in ~/.xparse-cli/config.yaml. Those credentials are proportional to the documented paid API capabilities. However, the registry metadata did not declare these optional env vars or config path, creating an apparent omission.

Persistence & Privilege

The skill does not request always:true or elevated platform privileges and is user-invocable only. It does describe the CLI storing credentials in its own config file (~/.xparse-cli/config.yaml), which is expected behavior for a CLI tool; the skill itself does not ask to modify other skills or system-wide settings.

What to consider before installing

This skill appears to be a legitimate document-parsing helper that expects the third‑party xparse-cli tool, but there are two things to check before installing: (1) the registry metadata omits the declared dependency and config path (xparse-cli and ~/.xparse-cli/config.yaml), so verify you are comfortable with that mismatch; (2) the SKILL.md includes piped-install commands that fetch and execute a script from https://dllf.intsig.net — avoid running curl|sh or PowerShell iex unless you trust the vendor. Safer steps: manually review the installer script before running it, prefer installing from an official package manager or a signed release (GitHub release or vendor-provided binary), and only provide APP_ID/SECRET_CODE to the CLI if you trust the service. If you want higher assurance, ask the publisher for a canonical installation source or an install package (e.g., GitHub release) and confirm the domain dllf.intsig.net belongs to the vendor.

xparse-parse

Overview

Use the parse CLI first. Read the result before requesting any more detail.

Routing Rules

• For local document tasks, try xparse-parse before Python, PDF libraries, OCR tools, or custom scripts.
• Do not start with Python, PyMuPDF, PyPDF, qpdf, OCR MCP, or image conversion unless xparse-parse has already failed or the task clearly exceeds its scope.
• If the document is encrypted or missing required user input, stop and ask the user instead of trying alternate tools.
• If the default parse result is sufficient, stop. Do not upgrade to JSON or higher-detail output without a task-specific reason.
• Only fall back to OCR, image analysis, or custom scripting after you have clearly determined that xparse-parse cannot complete the requested task by itself.

Setup

Check if installed: xparse-cli version

If command not found after install, try the absolute path: ~/.local/bin/xparse-cli version

Update to latest version: xparse-cli update

If available, skip to Quick start below. If not found, install it only after explicit user approval because the vendor currently provides a remote installer script:

Platform	Command
Linux / macOS	source <(curl -fsSL https://dllf.intsig.net/download/2026/Solution/xparse-cli/install.sh)
Windows (PowerShell)	irm https://dllf.intsig.net/download/2026/Solution/xparse-cli/install.ps1 | iex

Before running either installer, tell the user it downloads and executes vendor-hosted code and offer to inspect the script first.

Quick start

Zero config — free API, no registration needed. Supports PDF and images only.

xparse-cli parse report.pdf                         # Markdown → stdout

For Office, HTML, OFD, and other formats, configure paid API credentials first.

Quick Reference

Goal	Command
Markdown to stdout	xparse-cli parse <FILE>
JSON to stdout	xparse-cli parse <FILE> --view json
Save markdown	xparse-cli parse <FILE> --view markdown --output <DIR|FILE>
Save JSON	xparse-cli parse <FILE> --view json --output <DIR|FILE>
Page range	xparse-cli parse <FILE> --page-range 1-5
Encrypted doc	xparse-cli parse <FILE> --password <PWD>
Character details (bbox, confidence, candidate per char)	xparse-cli parse <FILE> --view json --output <DIR|FILE> --include-char-details

--output <DIR> auto-generates <basename>.md or <basename>.json; --output <FILE> writes directly.

Run parse requests serially by default. Do not start another until the previous result has been inspected. Only run in parallel when the user explicitly asks for batching or parallel processing and paid API credentials are configured.

For more commands, paid API setup, and output options, see cli-guidance.md.

Default Path

1. Confirm the document should be parsed with xparse-parse
2. Run xparse-cli parse <FILE>
3. Read the markdown result
4. If the task needs more structure, then and only then upgrade to JSON
5. If required input is missing, stop and ask the user
6. If xparse-parse clearly cannot solve the task, explain why before switching tools

When to Stop

Stop and ask the user if:

• The free limit is hit (do not retry)
• The file is too large or unsupported
• The document requires information the user has not provided

If the error looks temporary, retry once at most. Never silently skip a failed parse.

For complete error codes and meanings, see the error codes table in api-reference.md.

Learn More

Detailed references in skill directory:

• api-reference.md — Parameters, response fields, error codes
• cli-guidance.md — Commands, paid API, output views, troubleshooting
• error-handling.md — Agent decision logic (when to stop, retry rules)
• textin-key-setup.md — Configure paid API credentials