by 安全扫描
OpenClaw
安全
high confidenceThe skill's requests and runtime instructions are consistent with an OCR API client: it only asks for a DeepRead API key and shows curl examples to call the DeepRead service, with no unexpected installs or extra credentials.
评估建议
This skill appears coherent for calling a third‑party OCR API, but before installing: (1) Only set DEEPREAD_API_KEY as an environment variable — do not hardcode keys into configs. (2) Review the sensitivity of documents you will upload; OCR sends document contents to DeepRead's servers. (3) If you use webhook callbacks, ensure webhook endpoints are under your control and validate incoming requests (e.g., signature or shared secret) to avoid accepting forged payloads. (4) Confirm DeepRead's secur...详细分析 ▾
✓ 用途与能力
Name/description (OCR extraction, structured data, HIL) match the declared requirements and examples. The only required credential is DEEPREAD_API_KEY, which is appropriate for a hosted OCR API.
✓ 指令范围
SKILL.md instructs the agent to upload files to https://api.deepread.tech and to poll or receive webhook callbacks. It only references DEEPREAD_API_KEY and user-supplied webhook URLs; there are no instructions to read unrelated system files, environment variables, or send data to unexpected endpoints.
✓ 安装机制
No install spec or code files are present (instruction-only), so nothing is written to disk or downloaded during install. This is the lowest-risk pattern for a connector skill.
✓ 凭证需求
Only one required environment variable (DEEPREAD_API_KEY) is declared and used in the instructions. No unrelated secrets or system config paths are requested.
✓ 持久化与权限
always is false and disable-model-invocation is true (skill cannot autonomously invoke the model), so the skill does not request elevated persistent privileges or autonomous model access. It does not attempt to modify other skills or system-wide configs.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/1/31
Added BYOK section and cross-links to all DeepRead skills (form-fill, PII, agent-setup, BYOK).
● 无害
安装命令
点击复制官方npx clawhub@latest install deepread-ocr
镜像加速npx clawhub@latest install deepread-ocr --registry https://cn.longxiaskill.com