Ocr Document
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This OCR skill is coherent and purpose-aligned, but users should notice that documents are uploaded to MinerU’s cloud and an external CLI must be installed.
This skill appears safe to use for its stated OCR purpose. Before installing, make sure you are comfortable installing the MinerU CLI and sending the documents you OCR to MinerU's cloud service, especially if they contain personal, legal, medical, financial, or business-sensitive information.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the skill means trusting the MinerU CLI package to run locally on the user's machine.
The skill depends on installing an external CLI package from package managers or Go; this is purpose-aligned for an OCR CLI skill, but users are relying on that package's provenance and behavior.
"install":[{"id":"npm","kind":"node","package":"mineru-open-api"...},{"id":"uv","kind":"uv","package":"mineru-open-api"...},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api"...}]Install from the documented official source, verify the package name and publisher where possible, and keep the CLI updated.
Private scans, photos, PDFs, or handwritten notes may be transmitted to MinerU's cloud service during OCR.
The skill clearly discloses that document contents are sent to an external cloud service for OCR, which is expected for this workflow but important for sensitive documents.
`flash-extract` uploads the document to MinerU's cloud API for processing and returns the result. No account or API key is required.
Avoid using the skill on highly confidential documents unless the user is comfortable with MinerU's cloud processing and privacy terms.
If the optional authenticated OCR mode is used, the CLI may gain access tied to the user's MinerU account.
The primary workflow does not require credentials, but an optional documented mode uses MinerU authentication.
For higher precision OCR with full layout preservation, use `mineru-open-api extract --ocr` (requires auth via `mineru-open-api auth`)
Use authentication only when needed, understand what account permissions it grants, and revoke access if no longer needed.