pdf-ocr-skill
Warn
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/pdf_ocr_processor.pycontains aninstall_dependencyfunction that usessubprocess.check_callto executepip installcommands. This allows the skill to modify the system environment by installing software at runtime. - [EXTERNAL_DOWNLOADS]: The skill attempts to download and install several Python packages (
rapidocr_onnxruntime,rapid-doc,pymupdf,pillow) from external repositories if they are not already present on the system. - [DATA_EXFILTRATION]: When the 'siliconflow' engine is selected, the skill sends image data (converted to Base64) to an external API endpoint (
api.siliconflow.cn). While this is consistent with the stated purpose of cloud-based OCR, it involves transmitting potentially sensitive document content to a third-party service.
Audit Metadata