The Agent Skills Directory

[COMMAND_EXECUTION]: The JXA integration script (scripts/convert.js) utilizes app.doShellScript to bridge the macOS environment with the Python OCR processor. This script correctly employs shell quoting for all user-supplied and environment-derived arguments to prevent command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill performs legitimate network operations to communicate with OCR service providers (MinerU and PaddleOCR). It also includes functionality to download remote image assets referenced within the OCR-generated Markdown to ensure archival integrity.
[SAFE_PRACTICE]: The implementation demonstrates high security awareness by explicitly disabling environment-based proxy configuration (trust_env=False) in its HTTP clients. This prevents potential instability or exploitation caused by malformed proxy environment variables in restricted or automated execution environments.
[SAFE_PRACTICE]: API tokens and service endpoints are managed through standardized .env files and environment variables. The codebase contains no hardcoded credentials and provides clear instructions for secure local configuration.

legal-ocr