Local GLM OCR with llama.cpp on AIPC(no API Key)

• Analyzed: May 16, 2026, 7:49 AM
• Findings: 1
• Version: 1.0.4
• Hash: 31f35ca7c489d5ed7e320882248484d35d3e59d1d6b722c2d2176db0239ac1e5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill performs high-risk actions including downloading and executing prebuilt binaries (llama-server.exe) from GitHub (install_llama.py) and potentially installing the Miniforge Python distribution. While these actions are documented in SKILL.md and aligned with the stated goal of local OCR, the automated fetching and execution of remote artifacts, combined with the use of subprocesses to run local servers (ocr_run.py), constitutes a significant attack surface. No evidence of intentional malice or data exfiltration was found, but the inherent risks of binary execution and environment modification warrant a suspicious classification.