[Fix] Fix incorrect env var name and update for security (#17799)

* Fix env name

* Fix for more secure settings

* Fix .env

* Add security notice

Author: Bobholamovic

skills/.env.example

@@ -1,53 +1,36 @@
 # ============================================
 # PaddleOCR Skills Configuration
 # ============================================
-# Copy this file to .env and fill in your configuration
+# Copy this file to .env and fill in your configuration.
 # This is a single shared template for all PaddleOCR skills in this repository.
 # Get your API credentials at: https://paddleocr.com
 
 # ============================================
-# Text Recognition Configuration
+# Shared Configuration
 # ============================================
 
-# API URL (full address, including /ocr)
-# Example: PADDLEOCR_OCR_API_URL=https://example.aistudio-app.com/ocr
-PADDLEOCR_OCR_API_URL=
-
-# Access Token (plain token string, shared between skills)
+# Access token (shared between skills)
 # Example: PADDLEOCR_ACCESS_TOKEN=your_access_token_here
 PADDLEOCR_ACCESS_TOKEN=
 
 # ============================================
-# Document Parsing Configuration
-# ============================================
-# Advanced document parsing with layout analysis
-# Get your API credentials at: https://paddleocr.com
-
-# Document Parsing API URL (full endpoint address)
-# Example: PADDLEOCR_DOC_PARSING_API_URL=https://xxxxx.aistudio-app.com/layout-parsing
-PADDLEOCR_DOC_PARSING_API_URL=
-
-# ============================================
-# Optional: Text Recognition Configuration
+# Text Recognition Configuration
 # ============================================
 
-# Request timeout (milliseconds, default 25000)
-# PADDLEOCR_OCR_TIMEOUT=25000
+# API URL (get the full URL from the PaddleOCR website)
+# Example: PADDLEOCR_OCR_API_URL=https://example.aistudio-app.com/ocr
+PADDLEOCR_OCR_API_URL=
 
-# Log level (DEBUG/INFO/WARNING/ERROR, default INFO)
-# PADDLEOCR_LOG_LEVEL=INFO
+# Request timeout in seconds (default 120)
+# PADDLEOCR_OCR_TIMEOUT=120
 
 # ============================================
-# Optional: Document Parsing Configuration
+# Document Parsing Configuration
 # ============================================
 
-# Request timeout (seconds, default 120)
-# PADDLEOCR_DOC_PARSING_TIMEOUT=120
-
-# Log level (DEBUG/INFO/WARNING/ERROR, default INFO)
-# PADDLEOCR_PARSING_LOG_LEVEL=INFO
+# API URL (get the full URL from the PaddleOCR website)
+# Example: PADDLEOCR_DOC_PARSING_API_URL=https://example.aistudio-app.com/layout-parsing
+PADDLEOCR_DOC_PARSING_API_URL=
 
-# Max file size for local files (MB, default 20)
-# Increase this if you need to process larger files locally
-# Note: For very large files, consider using --file-url instead
-# PADDLEOCR_PARSING_MAX_FILE_SIZE_MB=20
+# Request timeout in seconds (default 600)
+# PADDLEOCR_DOC_PARSING_TIMEOUT=600

skills/README.md

@@ -63,10 +63,10 @@ After installation, configure the required environment variables so the skills c
 
 | Skill | Required | Optional |
 | --- | --- | --- |
-| `paddleocr-text-recognition` | `PADDLEOCR_OCR_API_URL` (API URL), `PADDLEOCR_ACCESS_TOKEN` (access token) | `PADDLEOCR_OCR_TIMEOUT` (timeout) |
-| `paddleocr-doc-parsing` | `PADDLEOCR_DOC_PARSING_API_URL` (API URL), `PADDLEOCR_ACCESS_TOKEN` (access token) | `PADDLEOCR_DOC_PARSING_TIMEOUT` (timeout) |
+| `paddleocr-text-recognition` | `PADDLEOCR_OCR_API_URL` (API URL), `PADDLEOCR_ACCESS_TOKEN` (access token) | `PADDLEOCR_OCR_TIMEOUT` (API request timeout) |
+| `paddleocr-doc-parsing` | `PADDLEOCR_DOC_PARSING_API_URL` (API URL), `PADDLEOCR_ACCESS_TOKEN` (access token) | `PADDLEOCR_DOC_PARSING_TIMEOUT` (API request timeout) |
 
-You can ask the AI in natural language (e.g., "I need to configure paddleocr-text-recognition skill"), or configure manually. Below are manual configuration methods for some AI apps:
+Below are configuration methods for some AI apps:
 
 - **Claude Code**: add an `env` field to `.claude/settings.local.json` in your project:
 
@@ -105,6 +105,8 @@ You can ask the AI in natural language (e.g., "I need to configure paddleocr-tex
   }
   ```
 
+  Please note that this approach may store the access token in plain text in the configuration file. A more secure way is to configure it through the OpenClaw onboarding wizard or the dashboard.
+
 ### Usage Examples
 
 After configuration, describe the OCR or document parsing task in natural language and provide a file URL or local path so the AI app can invoke the corresponding skill.

skills/README_cn.md

@@ -63,10 +63,10 @@ git clone https://github.com/PaddlePaddle/PaddleOCR.git
 
 | Skill | 必填 | 可选 |
 | --- | --- | --- |
-| `paddleocr-text-recognition` | `PADDLEOCR_OCR_API_URL`（API URL）、`PADDLEOCR_ACCESS_TOKEN`（access token） | `PADDLEOCR_OCR_TIMEOUT`（超时时间） |
-| `paddleocr-doc-parsing` | `PADDLEOCR_DOC_PARSING_API_URL`（API URL）、`PADDLEOCR_ACCESS_TOKEN`（access token） | `PADDLEOCR_DOC_PARSING_TIMEOUT`（超时时间） |
+| `paddleocr-text-recognition` | `PADDLEOCR_OCR_API_URL`（API URL）、`PADDLEOCR_ACCESS_TOKEN`（access token） | `PADDLEOCR_OCR_TIMEOUT`（API 请求超时时间） |
+| `paddleocr-doc-parsing` | `PADDLEOCR_DOC_PARSING_API_URL`（API URL）、`PADDLEOCR_ACCESS_TOKEN`（access token） | `PADDLEOCR_DOC_PARSING_TIMEOUT`（API 请求超时时间） |
 
-可以直接用自然语言告诉 AI（例如：”我需要配置 paddleocr-text-recognition skill”），也可以手动配置。以下是部分 AI 应用的手动配置方式：
+以下是部分 AI 应用的配置方式：
 
 - **Claude Code**：在项目的 `.claude/settings.local.json` 中添加 `env` 字段：
 
@@ -105,6 +105,8 @@ git clone https://github.com/PaddlePaddle/PaddleOCR.git
   }
   ```
 
+  请注意这种方式可能在配置文件中明文存储 access token。更安全的方式是通过 OpenClaw onboarding wizard 或者 dashboard 配置。
+
 ### 使用示例
 
 配置完成后，可以直接用自然语言描述 OCR 或文档解析需求，并附上文件 URL 或本地路径，让 AI 应用调用对应 skill。以下是部分提示词示例：

skills/paddleocr-doc-parsing/SKILL.md

@@ -209,19 +209,21 @@ PADDLEOCR_DOC_PARSING_API_URL not configured. Get your API at: https://paddleocr
 
 1. **Show the exact error message** to the user (including the URL).
 
-2. **Explain which environment variables are required**:
-   ```
-   Configure these values in the host application, runtime environment, or another appropriate config file:
-   - PADDLEOCR_DOC_PARSING_API_URL
-   - PADDLEOCR_ACCESS_TOKEN
-   - Optional: PADDLEOCR_DOC_PARSING_TIMEOUT
-   ```
-
-3. **If the user provides credentials in chat** (accept any reasonable format):
+2. **Guide the user to configure securely**:
+   - Recommend configuring through the host application's standard method (e.g., settings file, environment variable UI) rather than pasting credentials in chat.
+   - List the required environment variables:
+     ```
+     - PADDLEOCR_DOC_PARSING_API_URL
+     - PADDLEOCR_ACCESS_TOKEN
+     - Optional: PADDLEOCR_DOC_PARSING_TIMEOUT
+     ```
+
+3. **If the user provides credentials in chat anyway** (accept any reasonable format):
    - `PADDLEOCR_DOC_PARSING_API_URL=https://xxx.paddleocr.com/layout-parsing, PADDLEOCR_ACCESS_TOKEN=abc123...`
    - `Here's my API: https://xxx and token: abc123`
    - Copy-pasted code format
    - Any other reasonable format
+   - **Security note**: Warn the user that credentials shared in chat may be stored in conversation history. Recommend setting them through the host application's configuration instead when possible.
 
 4. **Parse and validate the values**:
    - Extract `PADDLEOCR_DOC_PARSING_API_URL` (look for URLs with `paddleocr.com` or similar)

skills/paddleocr-text-recognition/SKILL.md

@@ -9,7 +9,7 @@ metadata:
       env:
         - PADDLEOCR_OCR_API_URL
         - PADDLEOCR_ACCESS_TOKEN
-        - PADDLEOCR_TIMEOUT
+        - PADDLEOCR_OCR_TIMEOUT
       bins:
         - python
     primaryEnv: PADDLEOCR_ACCESS_TOKEN
@@ -167,19 +167,21 @@ CONFIG_ERROR: PADDLEOCR_OCR_API_URL not configured. Get your API at: https://pad
 
 1. **Show the exact error message** to the user (including the URL).
 
-2. **Explain which environment variables are required**:
-   ```
-   Configure these values in the host application, runtime environment, or another appropriate config file:
-   - PADDLEOCR_OCR_API_URL
-   - PADDLEOCR_ACCESS_TOKEN
-   - Optional: PADDLEOCR_OCR_TIMEOUT
-   ```
+2. **Guide the user to configure securely**:
+   - Recommend configuring through the host application's standard method (e.g., settings file, environment variable UI) rather than pasting credentials in chat.
+   - List the required environment variables:
+     ```
+     - PADDLEOCR_OCR_API_URL
+     - PADDLEOCR_ACCESS_TOKEN
+     - Optional: PADDLEOCR_OCR_TIMEOUT
+     ```
 
-3. **If the user provides credentials in chat** (accept any reasonable format):
+3. **If the user provides credentials in chat anyway** (accept any reasonable format):
    - `PADDLEOCR_OCR_API_URL=https://xxx.paddleocr.com/ocr, PADDLEOCR_ACCESS_TOKEN=abc123...`
    - `Here's my API: https://xxx and token: abc123`
    - Copy-pasted code format
    - Any other reasonable format
+   - **Security note**: Warn the user that credentials shared in chat may be stored in conversation history. Recommend setting them through the host application's configuration instead when possible.
 
 4. **Parse and validate the values**:
    - Extract `PADDLEOCR_OCR_API_URL` (look for URLs with `paddleocr.com` or similar)