PDF OCR — Convert PDF to Markdown via WiseDiag cloud API (requires WISEDIAG_API_KEY). Files are uploaded to WiseDiag servers for processing. Supports table r...
Security Analysis
high confidenceThe skill appears to do what it claims (upload PDFs to WiseDiag and return Markdown) and only requests an API key needed for that, but it will transmit your files to a third party so you should not use it for sensitive documents unless you trust WiseDiag.
The skill name/description (PDF→Markdown OCR via WiseOCR/WiseDiag) aligns with the included code and instructions: the script uploads PDFs to WiseDiag's API and saves returned Markdown. Note: the registry metadata at the top of the package summary indicated "Required env vars: none", but the SKILL.md and the script both require WISEDIAG_API_KEY — this is an internal manifest inconsistency (likely an authoring mistake) but does not change the overall capability alignment.
The SKILL.md and README explicitly instruct the agent/user to use the provided script; the script only reads the input PDF, the WISEDIAG_API_KEY env var, and writes the Markdown output. All network calls are to the stated service (default https://openapi.wisediag.com). The skill includes an explicit privacy warning about uploading files to WiseDiag.
No install spec in the registry (instruction-only skill) and dependencies are minimal (requests via requirements.txt). No downloads from untrusted URLs or extraction of arbitrary archives are present. Installing dependencies via pip is proportional for a small Python CLI.
The only credential the script uses is WISEDIAG_API_KEY which is appropriate and expected for a cloud OCR API. However, the package-level metadata in the supplied summary (top-level fields) incorrectly listed no required env vars while SKILL.md and the script require the API key — a discrepancy to be aware of. No other secrets or unrelated environment variables are requested.
The skill does not request always:true and does not modify other skills or system-wide config. It writes only its own output files (default ./WiseOCR) and suggests storing the API key in shell config as a convenience (typical but optional).
Guidance
This skill will upload any PDF you give it to WiseDiag (https://openapi.wisediag.com) for OCR, so do not use it with sensitive or confidential documents unless you explicitly trust WiseDiag's handling and are comfortable placing an API key in your environment. Verify the WISEDIAG_API_KEY is set only for the account you intend to use and rotate or remove the key after use if needed. Note the manifest inconsistency: the top-level metadata omitted the required env var while SKILL.md and the script require WISEDIAG_API_KEY — expect to provide that key. If you need offline processing for privacy reasons, use a local OCR tool instead.
Latest Release
v1.0.9
- Updated SKILL.md to remove Chinese examples and keywords, using only English filenames and terms for usage instructions and examples. - Generalized usage documentation (e.g., example filenames like "medical_report" instead of "体检报告"). - No changes were made to the code or functionality.
More by @wisediag
Published by @wisediag on ClawHub
