技能 scanlume-ocr-api
📦
scanlume-ocr-api
内容修订 r1 高风险 🌐 网络访问🔑 环境变量⚙️ 外部命令
使用 Scanlume OCR 提取文本
团队经常需要针对截图、收据和基于图像的表格进行可靠的 OCR。此技能可指导 Claude、Codex 和 Claude Code 调用 Scanlume API 并处理结构化 OCR 输出。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "scanlume-ocr-api" from https://skillstore.io/skills/daanaagua-scanlume-ocr-api.md and its manifest at https://skillstore.io/api/skills/daanaagua-scanlume-ocr-api/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“scanlume-ocr-api”。 包含商品名称、价格和总计的收据截图。
预期结果:
清晰的文本提取结果，列出明细项、小计、税费、总计，并标注不清晰的字段。
正在使用“scanlume-ocr-api”。 一张包含分组行的小型销售表格图像。
预期结果:
结构化表格摘要，包含列、行分组、记录数量以及格式化 OCR 响应中的任何备注。
正在使用“scanlume-ocr-api”。 包含标题和段落的产品设置截图。
预期结果:
可用于 Markdown 的文档，保留标题、段落和可读顺序。
安全审计
高风险v4 • 2026/7/5 打开版本化报告
Review found a legitimate OCR integration that sends local image data to the Scanlume API and handles a bearer API key. Most Markdown backtick findings are false positives, but the helper has real network, secret-handling, and command-execution risk. The main added concern is that an overridden base URL can receive the Authorization header.
5
已扫描文件
667
分析行数
23
复核项
0
已忽略误报
已确认安全问题 (2)
高
API Key Exposure Through Base URL Override
The helper accepts an explicit or environment-provided base URL and sends Authorization bearer credentials to that computed endpoint. A malicious invocation could redirect the Scanlume API key to an untrusted server.
The code directly combines base URL override support with bearer-token request construction, which is a clear credential redirection risk.
中
Local Image Content Uploaded To External OCR Service
The helper reads a local file, encodes it as a data URL, and posts it to the Scanlume OCR API. Sensitive screenshots or documents may be disclosed if user consent and data handling are unclear.
The helper reads local bytes, builds a base64 data URL, and submits the payload through the API request path.
能力复核项 (23)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Generic API/secret keys
value = explicit or os.environ.get("SCANLUME_API_KEY")
The helper reads a Scanlume API key from the environment. This is legitimate for authentication, but it is real secret access.
高
Generic API/secret keys
def perform_request(base_url: str, api_key: str, payload: dict[str, str], timeout: int) -> dict[str,
The request helper accepts an api_key parameter that is later used for authentication. This is expected, but it is part of the credential transmission path.
高
Generic API/secret keys
"Authorization": f"Bearer {api_key}",
The Authorization header is built from the API key and sent with the request. If the endpoint is overridden, the credential can be exposed.
高
Generic API/secret keys
parser.add_argument("--api-key", help="Override SCANLUME_API_KEY.")
The CLI accepts an API key argument. Command-line secrets can leak through shell history, logs, or process listings.
高
Generic API/secret keys
api_key = require_api_key(args.api_key)
The main flow loads the API key before making the OCR request. This is legitimate, but it confirms runtime secret handling.
高
Generic API/secret keys
response_json = perform_request(base_url, api_key, payload, args.timeout)
The loaded API key is passed into the outbound request. This is expected for Scanlume auth, but it is credential transmission over the network.
中
Ruby/shell backtick execution
5. If the user gives a local file path, prefer `scripts/scanlume_ocr.py` to build the data URL and c
The workflow tells the agent to prefer the local Python helper when given a local file path. This can read local files and submit their contents to an external API.
中
Ruby/shell backtick execution
- Use `python scripts/scanlume_ocr.py <path> --mode formatted --output md` for a local table image.
The helper command example runs a Python script on a user-provided path. This is intended, but it is real external command execution.
中
Ruby/shell backtick execution
- Use `python scripts/scanlume_ocr.py <path> --mode simple --output txt` for plain text extraction.
The helper command example runs a Python script on a user-provided path. This is intended, but it is real external command execution.
中
Ruby/shell backtick execution
5. Se o usuario fornecer um caminho local, prefira `scripts/scanlume_ocr.py` para gerar a data URL e
The Portuguese workflow tells the agent to prefer the local Python helper for user-provided paths. This can read local files and call the API.
中
Ruby/shell backtick execution
- Use `python scripts/scanlume_ocr.py <path> --mode formatted --output md` para uma imagem local com
The Portuguese helper example runs the local Python script for formatted OCR. This is real external command execution.
中
Ruby/shell backtick execution
- Use `python scripts/scanlume_ocr.py <path> --mode simple --output txt` para extracao simples de te
The Portuguese helper example runs the local Python script for simple OCR. This is real external command execution.
低
Hardcoded URL
short_description: "Image OCR / OCR de imagem for https://www.scanlume.com/."
The agent metadata names the external Scanlume service. This is expected for the skill, but it signals third-party OCR processing.
低
Hardcoded URL
default_prompt: "Use $scanlume-ocr-api to call https://www.scanlume.com/ for image OCR and return th
The default prompt directs the agent to call Scanlume for OCR. User image data can leave the local environment during normal use.
低
HTTP client library
def perform_request(base_url: str, api_key: str, payload: dict[str, str], timeout: int) -> dict[str,
The helper defines an outbound HTTP request function for the OCR endpoint. This is intended behavior, but it creates external data transfer risk.
低
HTTP client library
response_json = perform_request(base_url, api_key, payload, args.timeout)
The helper invokes the outbound request after building the OCR payload. Local image content is submitted to a network API.
低
Hardcoded URL
DEFAULT_BASE_URL = "https://api.scanlume.com"
The script hardcodes the default Scanlume API host. This is an expected external dependency, but it confirms network egress.
低
Hardcoded URL
parser.add_argument("--base-url", help="Override SCANLUME_BASE_URL. Default / Padrao: https://api.sc
The argument help documents a base URL override that controls the outbound endpoint. Misuse can redirect OCR payloads away from the official API.
低
Python environment access
value = explicit or os.environ.get("SCANLUME_BASE_URL") or DEFAULT_BASE_URL
The script reads SCANLUME_BASE_URL from the environment to decide the outbound endpoint. That configuration can affect where data is sent.
低
Python environment access
value = explicit or os.environ.get("SCANLUME_API_KEY")
The script reads SCANLUME_API_KEY from the environment. This is expected API authentication, but it handles a sensitive credential.
低
Hardcoded URL
description: Use when calling the Scanlume OCR API for screenshots, JPG, PNG, or image-based tables,
The skill description identifies Scanlume as the external OCR provider. Normal use can send user images to that third party.
低
Hardcoded URL
Use this skill when the task is specifically about calling the public OCR API behind [https://www.sc
The instructions say the skill is for calling the public Scanlume OCR API. This confirms intended external network use.
低
Hardcoded URL
Use este skill quando a tarefa for especificamente chamar a API publica de OCR do [https://www.scanl
The Portuguese instructions also direct use of the public Scanlume OCR API. This confirms intended external network use.
风险因素
🌐 网络访问 (12)
🔑 环境变量 (15)
references/api-contract.md:17 references/api-contract.md:97 scripts/scanlume_ocr.py:21 scripts/scanlume_ocr.py:26 scripts/scanlume_ocr.py:25 scripts/scanlume_ocr.py:26 scripts/scanlume_ocr.py:29 scripts/scanlume_ocr.py:30 scripts/scanlume_ocr.py:70 scripts/scanlume_ocr.py:77 scripts/scanlume_ocr.py:152 scripts/scanlume_ocr.py:167 scripts/scanlume_ocr.py:174 SKILL.md:27 SKILL.md:78
⚙️ 外部命令 (38)
SKILL.md:17 SKILL.md:18 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:26 SKILL.md:27 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:37 SKILL.md:42 SKILL.md:46 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:59 SKILL.md:60 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:81 SKILL.md:88 SKILL.md:93 SKILL.md:97 SKILL.md:101 SKILL.md:102 SKILL.md:103 SKILL.md:104 SKILL.md:110 SKILL.md:111
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/daanaagua-scanlume-ocr-api/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/daanaagua-scanlume-ocr-api?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/daanaagua-scanlume-ocr-api?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/daanaagua-scanlume-ocr-api/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/daanaagua-scanlume-ocr-api.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
daanaagua. (2026). scanlume-ocr-api security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/daanaagua-scanlume-ocr-api/audits/4BibTeX 引用
@techreport{daanaagua-daanaagua-scanlume-ocr-api-2026,
author = {daanaagua},
title = {scanlume-ocr-api security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/daanaagua-scanlume-ocr-api/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "scanlume-ocr-api security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "daanaagua"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/daanaagua-scanlume-ocr-api/audits/4"
identifiers:
- type: other
value: "skillstore:daanaagua-scanlume-ocr-api:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 64
架构
85
可维护性
87
内容
69
社区
83
规范符合性
你能构建什么
将截图转换为文本
从界面截图中提取纯文本，用于笔记、支持工单或 QA 记录。
从图像中还原表格
使用格式化 OCR 保留收据、报告或捕获的电子表格中的表格结构。
自动化 OCR API 调用
准备 data URLs，调用 Scanlume 端点，并返回最适合下游工作的响应字段。
试试这些提示
提取纯文本
Use Scanlume OCR on this local image and return only the extracted plain text. Use simple mode unless structure is needed.
保留表格结构
Use formatted Scanlume OCR on this table image. Return a clean table summary and note any uncertain cells.
选择最佳输出
Inspect the image goal, choose simple or formatted OCR, and explain the selected mode before returning the final output.
构建 OCR 工作流
Create a repeatable Scanlume OCR workflow for a folder of screenshots. Include mode choice, output field selection, and error handling guidance.
最佳实践
- 当布局、标题或表格很重要时，使用格式化模式。
- 使用基于环境的密钥，而不是直接在提示中传递 API keys。
- 在将敏感图像发送到外部 OCR API 前，确认用户同意。
避免
- 不要声称此辅助工具支持公共 PDF OCR API。
- 除非用户接受外部处理，否则不要发送私密截图。
- 除非端点可信，否则不要覆盖 API base URL。
常见问题
此技能面向哪些图像类型？
它面向本地截图、JPG 文件、PNG 文件以及其他可推断 MIME type 的图像文件。
它支持 PDF OCR 吗？
不支持。辅助工具会阻止 PDF，因为公共 Scanlume PDF API 尚未普遍可用。
哪些工具可以使用此技能？
生成的元数据将 Claude、Codex 和 Claude Code 列为支持的工具。
简单模式和格式化模式有什么区别？
简单模式返回原始文本。格式化模式会保留结构、Markdown、HTML、块和表格摘要字段。
此技能需要 API key 吗？
需要。辅助工具需要通过环境或显式参数提供 Scanlume API key。
它可以对远程文件 URLs 执行 OCR 吗？
不能。已文档化的公共 API 需要完整的 base64 data URL，而不是远程文件 URL。