wps-ocr

A lightweight, high-performance file parsing tool that can quickly and accurately extract text, handwritten text, formulas, tables, documents and seals from...

Security Scan

This skill is an OCR client that sends user-provided files to the WPS/Kingsoft aiwrite.wps.cn service using a single environment key; its code, instructions, and requested environment access are largely consistent with that purpose, with a few minor inconsistencies and defensive checks worth noting.

Purpose & Capability

Name/description state an OCR connector for WPS OCR; the runtime instructions and included Python client send files to aiwrite.wps.cn and require a single env var (WPS_OCR_ACCESS_KEY). Requiring one service credential and the requests library is proportionate to the stated purpose.

Instruction Scope

SKILL.md explicitly warns that the file will be sent to Kingsoft servers and instructs running the bundled script with a URL or local path — this matches the code. Minor inconsistency: the docs say 'only verify the file type without performing any verification on the path', while the script actually checks file existence, type, and size before reading. The skill will read and base64-encode local files provided by the user and transmit them to the WPS endpoint, which is expected behavior for an OCR client but has privacy implications the user should understand.

Install Mechanism

No install specification (instruction-only install) and only a small Python script is included. Dependencies are limited to the requests package. No remote download/install of arbitrary archives or third-party binaries is present.

Credentials

The code uses a single environment variable WPS_OCR_ACCESS_KEY for the Authorization header, which is appropriate. Minor documentation inconsistency: the Chinese SKILL_zh metadata references WPS_OCR_CLIENT_SECRET while the code and English SKILL.md use WPS_OCR_ACCESS_KEY — the code expects WPS_OCR_ACCESS_KEY. No other unrelated secrets are requested.

Persistence & Privilege

The skill does not request always: true or any special persistent privileges, nor does it modify other skills or system-wide settings. The SKILL.md suggests storing the env var in ~/.openclaw/env which is a normal convenience step.

Assessment

This skill will upload any file you provide to Kingsoft/WPS (aiwrite.wps.cn) for OCR and requires you to set a WPS_OCR_ACCESS_KEY environment variable. If you plan to install or use it: (1) only use a key you control and are willing to have used for cloud processing, (2) do not upload sensitive or confidential files you wouldn't want sent to an external service, (3) be aware the script will read local files you point it at (it enforces existence, extension, and a 10MB size limit), and (4) note the minor doc inconsistency (SKILL_zh mentions a different env var name) — the implementation uses WPS_OCR_ACCESS_KEY. If you need higher assurance, review the full script locally or run it in a sandboxed environment and monitor network calls, or obtain an ephemeral API key you can revoke after testing.

🧭 Must-Read Before Use (30 Seconds)

[!WARNING] ⚠️ Important Privacy & Data Flow Notice

• Service Interaction Required: This skill will send the file you provide to the official Kingsoft Office server (aiwrite.wps.cn) for recognition.
• Data Visibility: Kingsoft Office services will access and process the content of your file.
• This skill supports local file uploads, and will only verify the file type without performing any verification on the path.

✅ Recommended Method: Environment Variables (Permission-Free, Instant Effect, Webchat-Friendly)

# Run in the terminal (effective immediately for the current session):
export WPS_OCR_ACCESS_KEY="your_client_access_key"

# Append the credential to the ~/.openclaw/env file
echo 'export WPS_OCR_ACCESS_KEY="your_client_access_key"' >> ~/.openclaw/env

[!TIP] 🔧 How to obtain the key?

• Get your API key: https://aiwrite.wps.cn/pdf/parse/accesskey/

✅ Environment Dependency Check Make sure the required libraries are installed:

pip install requests

🎯 Skill Execution Guide

1. Applicable Scenarios

Invoke this skill when the user’s intent includes any of the following:

• Sends a file and asks “What text is this?”, “Extract text”, or “Convert to text”.
• Uploads document screenshots, invoices, business cards, photos, or scanned files with mixed Chinese and English text to be recognized.
• Needs to translate or edit the file content (text extraction is a required first step).

2. Execution Actions

Once it is confirmed that text extraction is required, perform the following operations immediately: Input Processing: Obtain the file resource provided by the user (using a download link: url or a local file: path). Command Execution: Call the Python script for recognition. If the current environment supports command-line execution, construct the command as follows:

# use file download URL:
python3 skills/wps-ocr/scripts/wps_ocr.py --url <URL>
# use local file:
python3 skills/wps-ocr/scripts/wps_ocr.py --path <LOCAL-PATH>

Execution Flow

1. File Acquisition

The file will be sent to Kingsoft Office Cloud Service, which will download the file provided by the user.

2. File Validation

Verify that the file is in a supported format.

3. Recognize File Content

Identify elements such as text, images, tables, formulas, and other content in the file, and extract the text. ⚠️ Note: Image elements will be returned as placeholders; file elements will not be returned.

4. Return Results to the User

On success: Return all recognized text (concatenated into one string) and detailed detection information. On failure: Return error messages (e.g., "No text detected in the file", "API call failed", etc.).

OCR API Usage Notes

This skill relies on the WPS-OCR parsing and recognition capabilities hosted on Kingsoft Cloud Service. The current version is a free trial. To ensure stable operation, the cloud service enforces rate limiting. The service will reject requests under high concurrency; please use it appropriately. To experience the full features, visit the demo platform.