The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute specific system utilities. It invokes SetFile on macOS to preserve the original file creation dates and uses curl as a high-compatibility fallback for performing HTTP PUT requests (specifically for uploading PDF data to OCR service endpoints). These operations are contextually appropriate for the skill's PDF management functionality and are not used to execute arbitrary or malicious code.
[EXTERNAL_DOWNLOADS]: For its OCR functionality, the skill communicates with external APIs (specifically PaddleOCR and MinerU). It uploads PDF documents to these services and subsequently downloads the processed results, which may include JSON data or ZIP archives containing OCR text and coordinates. These network operations are necessary for the skill's primary function and target established service providers.
[CREDENTIALS_UNSAFE]: The skill demonstrates safe practices for managing sensitive information. It retrieves API tokens from environment variables and supports loading them from .env files, which are appropriately excluded from the repository. No hardcoded secrets or sensitive credentials were found in any of the scripts.
[DYNAMIC_EXECUTION]: The skill utilizes importlib and importlib.util for modular script loading. This allows the main entry points (like pdf-ocr.py) to load specific backend logic (such as pdf_ocr_mineru.py or pdf_ocr_paddle_api.py) only when needed. This is a standard architectural pattern for complex Python applications and does not involve executing untrusted remote code.
[DATA_EXFILTRATION]: No evidence of unauthorized data exfiltration was found. The skill processes user-provided PDF files and transmits them only to the OCR API endpoints configured by the user. It does not attempt to access sensitive local system files, SSH keys, or other private user data.

pdf-processor