Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward screenshot OCR helper that reads a user-provided image and extracts text, with no hidden network, persistence, or privilege behavior found.
Install this if you want local OCR for Chinese/English screenshots, especially Chinese exam material. Be aware that it is not language-configurable and will work poorly outside that scope; only provide image paths you intend the tool to read, and use the optional output path only where you want a JSON result file written.
The file presents the skill description and usage details primarily in Chinese, which can amount to forcing a specific language without user opt-in. The policy allows locale/language constraints only when the user is given a choice or the constraint is clearly documented and justified.
The function docstring states the skill extracts text from screenshots in Chinese, and the implementation is oriented toward Chinese-language processing. This imposes a locale/language assumption rather than offering the user a choice, which matches the policy concern for forced language behavior.
The OCR call uses a fixed lang='chi_sim+eng', which hard-codes language behavior instead of letting the user opt in to a locale. The same assumption is repeated later in the duplicate function body, reinforcing the policy violation.
A second definition of extract_text_from_screenshot again fixes OCR to chi_sim+eng, duplicating the same forced-language behavior. Repetition increases the likelihood that the locale restriction is pervasive and unintentional from a policy perspective.
The manifest descriptions and parameter text are written only in Chinese, including the primary skill description and parameter descriptions. This can amount to a language/locale policy issue when the skill does not offer any user language choice or document that it is intentionally limited to a Chinese-speaking context.
The natural-language parsing comments and downstream behavior target Chinese constructs such as 答案, 答：, and Chinese numbering forms. While functional, this embeds a specific language policy into the skill without presenting it as an explicit user choice.
