image-ocr
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads images from arbitrary user-provided URLs using
curlin the shell andrequests.get()in Python. While this is necessary for its primary function, it allows for the ingestion of untrusted remote content. - [COMMAND_EXECUTION]: The skill uses
curlto download images to/tmp/andfileto verify formats. These are controlled shell executions for standard utility purposes. - [REMOTE_CODE_EXECUTION]: The skill interacts with an external service (
api.ocr.space) using a public API key (helloworld). While this involves sending image data to a third party, it is an documented feature of the skill to provide OCR functionality without local dependencies.
Audit Metadata