xiaomi-ocr

Pass

Audited by Gen Agent Trust Hub on Nov 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads model weights and layout detection components from well-known sources including Hugging Face (SeerRay-Lab/Xiaomi-OCR-0) and the PaddlePaddle organization (PP-DocLayoutV3). It also installs standard Python dependencies from the official PyPI registry during the setup process.
  • [COMMAND_EXECUTION]: The skill uses system commands (nvidia-smi, ps, lsof) within runtime_monitor.py to identify the local inference process and provide hardware status updates. The scripts/selftest.py script also uses subprocess.run to verify the local MCP server's tool registration.
  • [PERSISTENCE]: The scripts/register_codex_mcp.py script modifies the user's ~/.codex/config.toml file. This action is part of the documented installation process to register the OCR tools within the Codex agent environment.
  • [DYNAMIC_EXECUTION]: The mcp_ocr_server.py file uses dynamic imports via __import__ to load the PIL.Image library within its PDF rendering function. This is a common implementation pattern for conditional dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from document images and PDFs through its tool parameters (image_path, pdf_path, image_base64).
  • Ingestion points: Files are read via ocr_image, ocr_pdf, kie_image, and vqa_image tools.
  • Boundary markers: The skill provides instructions to the agent to distinguish document content from the 'Runtime:' metadata block in outputs.
  • Capability inventory: The skill has access to local file reads, loopback network requests, and system monitoring commands.
  • Sanitization: The MCP server handles image normalization and PDF rendering before passing content to the local inference engine.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 10, 2026, 01:13 PM