The Agent Skills Directory

[DATA_EXPOSURE]: The skill uses the ZHIPU_API_KEY environment variable to authenticate requests to the ZhiPu API. This follows standard security practices for secret management by avoiding hardcoded credentials.
[EXTERNAL_DOWNLOADS]: The CLI script makes network requests to https://open.bigmodel.cn/api/paas/v4/layout_parsing. This is the official endpoint for the ZhiPu GLM-OCR service, which is a well-known AI platform.
[COMMAND_EXECUTION]: The skill executes a local Python script (scripts/glm_ocr_cli.py) to interact with the API. The script uses standard libraries and the requests package to perform its tasks.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (images or PDFs) to extract text. While this creates a surface for indirect prompt injection if the extracted text contains malicious instructions, the skill includes explicit 'Output Display Rules' in SKILL.md to guide the agent on how to handle and present the results safely.

glmocr-handwriting