📦 文档识别-表格识别（invoice-ocr-xy）翔云平台 — 技能工具
v1.0.0文档 OCR 识别技能。扫描文件夹中的文档（PDF/图片），调用翔云 OCR API 识别文档信息。**重要：首次使用必须先配置翔云凭证，主动向用户索要 netocr_key 和 netocr_secret，或引导用户运行 --config 命令自行配置。**
1· 27·0 当前·0 累计
by 安全扫描
OpenClaw
安全
high confidenceThe skill's code and instructions match its stated purpose (calling 翔云/NetOCR to OCR documents); nothing requests unrelated credentials or installs unusual software, but it stores user API keys in a local plaintext config and encourages the agent to ask the user for secrets — handle those carefully.
评估建议
This skill appears to do what it says: send document data to the NetOCR API to perform OCR. Before installing/using it: (1) Do not paste your netocr_key/netocr_secret into chat — instead run the script locally with --config to store credentials in the skill directory. (2) Be aware config.json stores credentials in plaintext under the skill folder; treat that file as sensitive and restrict access. (3) Documents you process are uploaded to a third-party service (netocr.com) — ensure you're comfort...详细分析 ▾
✓ 用途与能力
Name/description, SKILL.md, and scripts/recognize_doc.py consistently implement a document OCR skill that calls the netocr.com API. The script sends base64-encoded file data to https://netocr.com/api/recog_table_base64 and expects netocr_key/netocr_secret credentials — this is coherent with the stated purpose.
ℹ 指令范围
SKILL.md instructs the agent to scan folders or single files and to ask the user for netocr_key/netocr_secret or guide them to run the script with --config. The runtime instructions and code operate only on files the user points the script at and the NetOCR endpoint. Note: the skill's instructions explicitly recommend 'proactively asking the user' for credentials (see risk section).
✓ 安装机制
No install spec; this is an instruction + local Python script. No external downloads or package installs are performed automatically. The only optional dependency is Pillow (PIL) for image conversion, which is documented in the script.
ℹ 凭证需求
The skill does not request unrelated environment variables. It requires the NetOCR API key and secret, which is appropriate. However, credentials are saved in a local config.json inside the skill directory in plaintext (unencrypted). SKILL.md encourages the agent to 'actively ask' the user for credentials in conversation — this risks credential disclosure into chat logs or conversation history. Prefer local --config usage rather than pasting secrets into chat.
✓ 持久化与权限
Skill is user-invocable and not always-enabled; it does not request elevated privileges, does not modify other skills, and stores config only in its own skill directory. No persistent system-wide changes detected.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/16
- Initial release of doc-ocr: batch OCR document recognition using the Xiangyun OCR API. - Supports PDF, OFD, and common image formats (.jpg, .png, .tif, etc.). - Requires users to configure Xiangyun API credentials (netocr_key and netocr_secret) before first use. - Supports multiple languages, including Simplified/Traditional Chinese (print/handwriting), English, Arabic, Cyrillic, Japanese, Korean, and more. - Includes configuration commands for credential management and usage instructions. - Credentials and configuration are stored locally in the skill's directory.
● 无害
安装命令
点击复制官方npx clawhub@latest install doc-ocr-xy
镜像加速npx clawhub@latest install doc-ocr-xy --registry https://cn.longxiaskill.com镜像同步中