The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Python-based CLI to interact with the Zhipu AI GLM-OCR service. The execution is controlled through a dedicated script (scripts/glm_ocr_cli.py) that uses hardcoded official endpoints to prevent data exfiltration to unauthorized third-party URLs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (images and PDFs) which could theoretically contain instructions intended to influence the agent's behavior.
Ingestion points: Data enters the system via the --file (local path) or --file-url (remote URL) arguments in scripts/glm_ocr_cli.py.
Boundary markers: The skill does not explicitly use delimiters or "ignore" instructions when returning OCR results to the agent.
Capability inventory: The skill possesses the capability to read local files, perform network POST requests to the Zhipu API, and write result JSON files to the local disk.
Sanitization: The extracted text is returned as raw Markdown without specific filtering or sanitization of potential command-like patterns.
[CREDENTIALS_SAFE]: The skill includes a configuration utility (scripts/config_setup.py) that helps users store their API keys in a local .env file. This is a standard and recommended practice for secret management, and the utility includes security features like masking keys when displaying current configuration.

glmocr