A lightweight, high-performance file parsing tool that can quickly and accurately extract text, handwritten text, formulas, tables, documents and seals from...
Security Analysis
medium confidenceThis skill is an OCR client that sends user-provided files to the WPS/Kingsoft aiwrite.wps.cn service using a single environment key; its code, instructions, and requested environment access are largely consistent with that purpose, with a few minor inconsistencies and defensive checks worth noting.
Name/description state an OCR connector for WPS OCR; the runtime instructions and included Python client send files to aiwrite.wps.cn and require a single env var (WPS_OCR_ACCESS_KEY). Requiring one service credential and the requests library is proportionate to the stated purpose.
SKILL.md explicitly warns that the file will be sent to Kingsoft servers and instructs running the bundled script with a URL or local path — this matches the code. Minor inconsistency: the docs say 'only verify the file type without performing any verification on the path', while the script actually checks file existence, type, and size before reading. The skill will read and base64-encode local files provided by the user and transmit them to the WPS endpoint, which is expected behavior for an OCR client but has privacy implications the user should understand.
No install specification (instruction-only install) and only a small Python script is included. Dependencies are limited to the requests package. No remote download/install of arbitrary archives or third-party binaries is present.
The code uses a single environment variable WPS_OCR_ACCESS_KEY for the Authorization header, which is appropriate. Minor documentation inconsistency: the Chinese SKILL_zh metadata references WPS_OCR_CLIENT_SECRET while the code and English SKILL.md use WPS_OCR_ACCESS_KEY — the code expects WPS_OCR_ACCESS_KEY. No other unrelated secrets are requested.
The skill does not request always: true or any special persistent privileges, nor does it modify other skills or system-wide settings. The SKILL.md suggests storing the env var in ~/.openclaw/env which is a normal convenience step.
Guidance
This skill will upload any file you provide to Kingsoft/WPS (aiwrite.wps.cn) for OCR and requires you to set a WPS_OCR_ACCESS_KEY environment variable. If you plan to install or use it: (1) only use a key you control and are willing to have used for cloud processing, (2) do not upload sensitive or confidential files you wouldn't want sent to an external service, (3) be aware the script will read local files you point it at (it enforces existence, extension, and a 10MB size limit), and (4) note the minor doc inconsistency (SKILL_zh mentions a different env var name) — the implementation uses WPS_OCR_ACCESS_KEY. If you need higher assurance, review the full script locally or run it in a sandboxed environment and monitor network calls, or obtain an ephemeral API key you can revoke after testing.
Latest Release
v1.0.1
wps-ocr 1.0.0 - Initial release of the skill. - Supports high-performance extraction of text, handwriting, formulas, tables, documents, and seals from files into Markdown. - Compatible with JPG, PNG, BMP, HEIF, and WEBP image formats. - Sends files to Kingsoft Office server (aiwrite.wps.cn) for OCR processing. - Uses WPS_OCR_ACCESS_KEY as the required environment variable. - Included privacy and data flow notice; supports both URL and local file recognition.
Popular Skills
Published by @randyliu111 on ClawHub
