Extract text from images using GLM-OCR API. Supports images and PDFs with high accuracy OCR, table recognition, formula extraction, and handwriting recogniti...
Security Analysis
high confidenceThe skill's code, instructions, and required secrets are consistent with an OCR wrapper that posts images/PDFs to the GLM-OCR (bigmodel.cn) layout-parsing API; nothing in the provided files indicates unrelated or covert behavior.
Name/description (OCR, table/formula/handwriting extraction) align with the code and declared requirements. The skill only requires the GLM provider API key (ZHIPU_API_KEY) and an optional timeout, and the code posts to the official GLM endpoint (open.bigmodel.cn). Required files (Python scripts and a small requirements.txt) are proportionate to the task.
SKILL.md instructs the agent to run the provided CLI script(s) and to use only the official API. The code reads a .env in the skill directory (if present) and will base64-encode and upload either a user-supplied URL or a local file to the GLM endpoint — which is expected for an OCR skill. Note: because the skill uploads whichever file you point it at, do not supply paths to sensitive local files if you do not want them transmitted to the GLM service.
No automatic install spec; the package is instruction-only with included scripts. A requirements.txt lists only 'requests>=2.31.0'. The CLI prints a clear error if 'requests' is missing and instructs how to install it; no remote arbitrary binaries or archive downloads are present.
Only ZHIPU_API_KEY (primary credential) and GLM_OCR_TIMEOUT are required; both are justified. The config helper writes/reads a .env file inside the skill folder to persist the API key — this is expected but the user should avoid committing that file to version control.
Skill is not always-enabled and does not modify other skills or global agent settings. The only persistent change the provided tooling makes is creating/updating a .env file in the skill directory when the user runs the config setup — a normal configuration behavior.
Guidance
This skill appears to do what it says: it uploads the image/PDF you provide (URL or local file, base64-encoded) to the official GLM-OCR endpoint (open.bigmodel.cn) using your ZHIPU_API_KEY. Before installing or using it: (1) Do not pass sensitive documents you don't want uploaded to the remote service. (2) Keep the .env file containing your API key out of version control (config_setup.py even reminds you to add .env to .gitignore). (3) Confirm you trust the GLM provider (bigmodel.cn) with any data you send and rotate the API key if it may have been exposed. (4) If you want extra assurance, inspect the full, untruncated copy of glm_ocr_cli.py in your environment to confirm there are no additional network endpoints or unexpected behaviors beyond the visible code.
Latest Release
v1.0.4
Version 1.0.4 of the GLM-OCR skill - Fixed metadata: removed the unused "bins: python" requirement. - No functional changes to the code or CLI usage. - All documented features, security restrictions, and usage guidelines remain unchanged.
More by @jaredforreal
Published by @jaredforreal on ClawHub
