localmac-ai-ocr
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule and AppleScript (osascript) to perform GUI automation tasks, including window activation, keyboard input, and capturing screenshots via the macOSscreencaptureutility (inscripts/gui_toolkit.pyandscripts/ocr_tool.py). - [DATA_EXFILTRATION]: To perform character recognition, the skill captures screenshots and transmits them via HTTP POST requests to a user-defined external service (
AISTUDIO_OCR_API_URL). This is the primary function of the skill, and the endpoint and credentials are managed through environment variables rather than being hardcoded. - [COMMAND_EXECUTION]: The toolkit uses
ctypesto load the macOSApplicationServicesframework, allowing it to generate low-level mouse events (CGEventCreateMouseEvent) for clicking on interface elements based on OCR coordinates. - [EXTERNAL_DOWNLOADS]: The
scripts/setup.shandscripts/guiscripts utilize theuvpackage manager to install and synchronize Python dependencies (Pillow, requests) from specified package registries. - [SAFE]: The skill includes security-conscious design choices, such as a
doctorcommand that verifies the presence of credentials without printing their values and providing a.env.exampletemplate to prevent accidental credential leakage in the codebase.
Audit Metadata