Real-time OCR and data extraction API by Veryfi (https://veryfi.com). Extract structured data from receipts, invoices, bank statements, W-9s, purchase orders...
Security Analysis
high confidenceThe skill's requirements and runtime instructions match its stated purpose (calling the Veryfi OCR/document-extraction API) and request only the API credentials needed to use that service.
Name/description describe Veryfi document OCR/extraction and the skill only requires Veryfi API credentials (Client ID, Username, API Key) and references Veryfi endpoints — these are proportional and expected for the stated functionality.
SKILL.md contains explicit curl examples and guidance for uploading files, base64 content, or providing URLs to Veryfi endpoints. It does not instruct the agent to read unrelated system files, other services' credentials, or to exfiltrate data to unexpected endpoints.
No install spec or code is included — this is instruction-only, so nothing is written to disk or downloaded during install. Low risk from installation mechanics.
The three required environment variables (VERYFI_CLIENT_ID, VERYFI_USERNAME, VERYFI_API_KEY) match the Authorization pattern shown in the examples and are consistent with the Veryfi API. Nothing else (unrelated secrets or system config paths) is requested.
Skill is not marked always:true and does not request elevated platform privileges or modify other skills' configuration. Autonomous invocation is allowed by default but is not combined with other concerning properties here.
Guidance
This skill appears to be an instruction-only wrapper for the official Veryfi API and asks only for the API credentials it needs. Before installing: confirm you trust the skill publisher (registry owner) and prefer loading credentials from environment variables or your agent's secret store rather than embedding them in config files; limit the API key's permissions if possible; test with non-sensitive sample documents; review Veryfi's privacy/retention policy; and rotate keys regularly. If provenance is important, verify the repository/maintainer referenced in package.json (the skill references a Veryfi GitHub repo) before granting long-lived credentials.
Latest Release
v1.0.1
- Added support and documentation for extracting data from documents using base64 content and file URLs, in addition to file upload. - Updated description and examples to mention raw OCR text output ("ocr_text") in API responses. - Clarified when to use the generic "any-documents" endpoint for W-2 and W-8 forms. - Improved documentation structure, quick start, and included a direct link to Veryfi’s website for more information.
Popular Skills
Published by @dbirulia on ClawHub
