ppocrv5
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Python scripts (
scripts/ocr_caller.py,scripts/configure.py,scripts/smoke_test.py) to interact with the OCR API and manage local settings. - [SAFE]: Secret management is handled by a setup script that stores the
PADDLE_OCR_TOKENin a.envfile, avoiding hardcoded credentials in the source code and following industry best practices for local secret storage. - [SAFE]: The skill performs text extraction from user-provided images and URLs; although processing untrusted content is a known surface for indirect prompt injection, this behavior is essential for OCR functionality and the skill does not exhibit dangerous capability chaining such as executing extracted text or modifying system files.
Audit Metadata