The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads several binary and text-based assets during initialization to create a local OCR runtime.
Evidence: Found in scripts/bootstrap_runtime.py within the ASSETS constant. The sources include files.pythonhosted.org (PyPI), github.com/microsoft (Microsoft), github.com/firecrawl, and github.com/GreatV.
Security Controls: Every asset is verified using a hardcoded SHA-256 checksum immediately after download. The download mechanism uses urllib.request with specific byte-range fetching for efficiency and integrity.
[COMMAND_EXECUTION]: The skill invokes local command-line utilities for PDF and image processing.
Evidence: scripts/ocr_book.py uses subprocess.run to call pdftoppm (part of the Poppler suite) for rendering PDF pages and sips (a macOS native tool) for image rotation and conversion.
Security Controls: All subprocess calls use list-based arguments instead of shell strings, preventing command injection. The skill also explicitly checks for the presence of these tools before attempting to use them.
[REMOTE_CODE_EXECUTION]: The skill downloads and executes binary code in the form of shared libraries and a Python wheel.
Evidence: scripts/ocr_worker.py dynamically loads the downloaded libraries (libpdfium.dylib and libonnxruntime.dylib) by setting environment variables PDFIUM_LIB_PATH and ORT_DYLIB_PATH, and adds the downloaded wheel to sys.path.
Context: This dynamic loading is the core mechanism for providing a portable, consistent OCR environment without requiring global system installation. It is protected by the hash-verification step in the bootstrapper and is scoped to a local cache directory.

scanned-book-ocr