xiaomi-ocr
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads model weights and layout detection components from well-known sources including Hugging Face (SeerRay-Lab/Xiaomi-OCR-0) and the PaddlePaddle organization (PP-DocLayoutV3). It also installs standard Python dependencies from the official PyPI registry during the setup process.
- [COMMAND_EXECUTION]: The skill uses system commands (
nvidia-smi,ps,lsof) withinruntime_monitor.pyto identify the local inference process and provide hardware status updates. Thescripts/selftest.pyscript also usessubprocess.runto verify the local MCP server's tool registration. - [PERSISTENCE]: The
scripts/register_codex_mcp.pyscript modifies the user's~/.codex/config.tomlfile. This action is part of the documented installation process to register the OCR tools within the Codex agent environment. - [DYNAMIC_EXECUTION]: The
mcp_ocr_server.pyfile uses dynamic imports via__import__to load thePIL.Imagelibrary within its PDF rendering function. This is a common implementation pattern for conditional dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from document images and PDFs through its tool parameters (
image_path,pdf_path,image_base64). - Ingestion points: Files are read via
ocr_image,ocr_pdf,kie_image, andvqa_imagetools. - Boundary markers: The skill provides instructions to the agent to distinguish document content from the 'Runtime:' metadata block in outputs.
- Capability inventory: The skill has access to local file reads, loopback network requests, and system monitoring commands.
- Sanitization: The MCP server handles image normalization and PDF rendering before passing content to the local inference engine.
Audit Metadata