Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Word OCR
v0.2.0OCR and text extraction from Word documents (.docx, .doc) using the MinerU API. This skill leverages mineru-open-api CLI to perform optical character recogni...
⭐ 0· 63·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (OCR Word docs via mineru-open-api) aligns with the instructions, but registry metadata lists no required binaries or credentials while the SKILL.md explicitly instructs installing an npm CLI (npm install -g mineru-open-api). The absence of a declared dependency on npm/node or the mineru CLI in the metadata is an incoherence and reduces transparency. Also the registry entry provides no homepage/source to verify the package.
Instruction Scope
The SKILL.md stays on-topic (commands only target OCR of .doc/.docx). It instructs installing a global npm package and running mineru-open-api commands that read user-supplied Word files and write output to ~/MinerU-Skill/<name>_<hash>/. There are no instructions that access unrelated system paths or exfiltrate data, but the default output path and global install are operational details users should be aware of.
Install Mechanism
There is no install spec in the registry, but the instructions require a global npm install. Installing an npm package globally executes third‑party code on the host; without a homepage/source or provenance info this is higher-risk. If the mineru-open-api package on npm is legitimate and trusted this is typical, but the lack of source links in the skill metadata is a transparency gap.
Credentials
The SKILL.md says advanced/precision OCR requires a token and links to mineru.net for token management, but the skill metadata declares no required environment variables or primary credential. It's unclear how the token is provided to the CLI (env var, config file, interactive input), which is an omission that affects whether credentials may be stored or transmitted insecurely.
Persistence & Privilege
The skill does not request persistent/always-on privileges and is user-invocable only. It doesn't instruct changes to other skills or global agent settings. No elevated platform privileges are requested.
What to consider before installing
This skill appears to do what it says (OCR Word docs via mineru-open-api) but the registry metadata is missing provenance and required-dependency declarations. Before installing, verify the mineru-open-api package on npm (check publisher, download counts, repository, and source code). Confirm the mineru.net token workflow and how the CLI expects the token (env var, config file, or interactive). Prefer installing/testing the package in an isolated environment (container or VM) rather than globally on your main system. Avoid supplying sensitive credentials until you confirm the package origin and how tokens are stored/used. If you can't verify the package/source, treat this as untrusted and do not install globally.Like a lobster shell, security has layers — review code before you run it.
digitizevk9743ds8j3cs58j1y5n3de0nv184bcb5docxvk9743ds8j3cs58j1y5n3de0nv184bcb5imagevk9743ds8j3cs58j1y5n3de0nv184bcb5latestvk97cvyd4w531kd41bzyg8hp32d84bp1xmineruvk9743ds8j3cs58j1y5n3de0nv184bcb5ocrvk9743ds8j3cs58j1y5n3de0nv184bcb5recognitionvk9743ds8j3cs58j1y5n3de0nv184bcb5scanvk9743ds8j3cs58j1y5n3de0nv184bcb5scanned-documentsvk9743ds8j3cs58j1y5n3de0nv184bcb5text-extractionvk9743ds8j3cs58j1y5n3de0nv184bcb5vlmvk9743ds8j3cs58j1y5n3de0nv184bcb5wordvk9743ds8j3cs58j1y5n3de0nv184bcb5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.