image-ocr

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads images from arbitrary user-provided URLs using curl in the shell and requests.get() in Python. While this is necessary for its primary function, it allows for the ingestion of untrusted remote content.
  • [COMMAND_EXECUTION]: The skill uses curl to download images to /tmp/ and file to verify formats. These are controlled shell executions for standard utility purposes.
  • [REMOTE_CODE_EXECUTION]: The skill interacts with an external service (api.ocr.space) using a public API key (helloworld). While this involves sending image data to a third party, it is an documented feature of the skill to provide OCR functionality without local dependencies.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 04:31 PM