Security checks across malware telemetry and agentic risk
This OCR skill does what it says, but it can install packages during use and may send document images to a cloud OCR service without a clear consent boundary.
Review before installing. Use local OCR only for confidential PDFs or images, keep OCR_ENGINE=rapid, and avoid configuring a SiliconFlow API key unless remote processing is approved. Require the agent to ask before installing packages or using/falling back to cloud OCR, and prefer a locked environment with pinned dependencies.
"""自动安装缺失的依赖"""
print(f"正在安装依赖: {package}")
try:
subprocess.check_call([sys.executable, "-m", "pip", "install", package])
print(f"依赖 {package} 安装成功")
return True
except subprocess.CalledProcessError as e:# PDF OCR Skill Requirements # PDF处理 pymupdf>=1.23.0 # 图片处理 pillow>=9.0.0
pymupdf>=1.23.0 # 图片处理 pillow>=9.0.0 # HTTP请求 requests>=2.28.0
pillow>=9.0.0 # HTTP请求 requests>=2.28.0 # 环境变量管理 python-dotenv>=1.0.0
requests>=2.28.0 # 环境变量管理 python-dotenv>=1.0.0 # 本地OCR引擎（可选，推荐安装以获得更好的识别效果） rapidocr_onnxruntime>=1.3.0
python-dotenv>=1.0.0 # 本地OCR引擎（可选，推荐安装以获得更好的识别效果） rapidocr_onnxruntime>=1.3.0
66/66 vendors flagged this skill as clean.