glmocr-handwriting
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from images and PDFs via OCR, creating an attack surface where instructions embedded in the handwriting could influence agent behavior.
- Ingestion points: Image files or URLs are passed to the
scripts/glm_ocr_cli.pyscript for processing. - Boundary markers: No delimiters or explicit warnings are provided to separate the OCR output from the agent's instructions.
- Capability inventory: The output text is presented directly to the agent which then has the capability to interpret it as instructions.
- Sanitization: No sanitization is performed on the extracted text before it is returned to the agent.
- [EXTERNAL_DOWNLOADS]: The skill communicates with the ZhiPu GLM-OCR official endpoint (
https://open.bigmodel.cn/api/paas/v4/layout_parsing) to perform recognition tasks. - [COMMAND_EXECUTION]: The agent is instructed to execute a local Python script
scripts/glm_ocr_cli.pyto interact with the OCR API.
Audit Metadata