MinerU PDF Extractor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:22 PM UTC
• Version: 1.0.5

Overview

This skill appears purpose-aligned, but it handles API tokens, uploads PDFs to a third-party service, and extracts remote ZIP results with enough scoping and validation gaps to require review before installation.

Install only if you are comfortable sending PDFs, URLs, document metadata, and extracted results through MinerU-controlled services. Use a dedicated low-privilege MinerU token, do not inherit or set MINERU_BASE_URL from untrusted environments, avoid sensitive or regulated documents unless approved, and inspect downloaded ZIP contents in a controlled directory before trusting extracted files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/local_file_step1_apply_upload_url.sh:27

Finding

Unvalidated API Base URL Can Redirect Bearer Credentials to an Attacker-Controlled Server

Content

View full analysis

Remediation

View remediation

&2 exit 1 ;; esac ``` 3. Require HTTPS and reject embedded credentials, unexpected ports, fragments, and malformed hosts. Use a proper URL parser where possible rather than a permissive shell regular expression. 4. Use separate credentials for custom or test endpoints. Never send the production MinerU token to an endpoint merely because it was supplied through an environment variable. 5. Add `curl` hardening such as `--proto '=https' --fail-with-body --show-error` and reasonable connection and request timeouts. 6. Document that overriding an authenticated service endpoint is security-sensitive, and avoid inheriting the variable from untrusted job or wrapper environments. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/local_file_step3_poll_result.sh:25

Finding

Unvalidated Polling Arguments Are Evaluated in Bash Arithmetic Contexts

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi if [[ ! "$RETRY_INTERVAL" =~ ^[0-9]+$ ]]; then echo "Error: retry_interval must be a non-negative decimal integer" >&2 exit 1 fi if (( 10#$MAX_RETRIES < 1 || 10#$MAX_RETRIES > 1000 )); then echo "Error: max_retries is outside the permitted range" >&2 exit 1 fi if (( 10#$RETRY_INTERVAL > 3600 )); then echo "Error: retry_interval is outside the permitted range" >&2 exit 1 fi ``` Apply equivalent validation to arguments 3 and 4 of `online_file_step2_poll_result.sh`. Additional hardening: - Normalize validated values to integers before reuse. - Quote the sleep operand: `sleep "$RETRY_INTERVAL"`. - Enforce upper bounds to prevent excessive loops and denial of service. - Validate `BATCH_ID` and `TASK_ID` against their expected UUID or identifier format. - Prefer `set -euo pipefail` and explicitly handle failed HTTP and parsing operations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/local_file_step4_download.sh:71

Finding

Downloaded Result Archives Are Extracted Without Validating Individual Entry Paths

Content

View full analysis

/dev/null; then echo "❌ Error: Invalid ZIP file" rm -f "$ZIP_FILENAME" exit 1 fi echo "✅ Download complete: $ZIP_FILENAME ($(du -h "$ZIP_FILENAME" | cut -f1))" echo "" # Extract echo "📦 Extracting..." mkdir -p "$EXTRACT_DIR" unzip -q "$ZIP_FILENAME" -d "$EXTRACT_DIR" ``` The online-result script uses the same extraction approach: ```bash # Validate ZIP URL if [[ ! "$ZIP_URL" =~ ^https://cdn-mineru\.openxlab\.org\.cn/ ]]; then echo "❌ Error: Invalid ZIP URL from API" exit 1 fi # Download and extract echo "=== Download and Extract Results ===" mkdir -p "$OUTPUT_DIR" ZIP_NAME="result.zip" echo "📥 Downloading..." curl -L -o "${OUTPUT_DIR}/${ZIP_NAME}" "$ZIP_URL" # Validate ZIP if ! unzip -t "${OUTPUT_DIR}/${ZIP_NAME}" &>/dev/null; then echo "❌ Error: Invalid ZIP file downloaded" exit 1 fi echo "📦 Extracting..." unzip -q "${OUTPUT_DIR}/${ZIP_NAME}" -d "${OUTPUT_DIR}/extracted" ``` ### Technical Analysis `unzip -t` checks whether an archive is structurally valid and whether its compressed data passes integrity checks. It does not establish that every archive entry is safe to write. The scripts do not explicitly reject: - Absolute entry paths. - Entries containing `..` path components. - Unsafe symbolic links or link-based path traversal. - Special file types. - Excessive expansion ratios or uncompressed sizes. - Duplicate or conflicting paths. Behavior varie ...[truncated 1824 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (59)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/Local_File_Parsing_Guide.md (reported line 270)May include surrounding context.

md

# 安全检查: 验证 URL 格式
    # 必须以 http:// 或 https:// 开头，以 .pdf 结尾
    # 这可以防止：
    # - 文件协议攻击 (file:///etc/passwd)
    # - JavaScript 协议攻击 (javascript:alert(1))
    # - 其他恶意协议
    if [[ ! "$url" =~ ^https?://[a-zA-Z0-9.-]+/.*\.pdf$ ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/MinerU_在线文档解析完整流程.md (reported line 217)May include surrounding context.

md

# 安全检查: 验证 URL 格式
    # 必须以 http:// 或 https:// 开头，以 .pdf 结尾
    # 这可以防止：
    # - 文件协议攻击 (file:///etc/passwd)
    # - JavaScript 协议攻击 (javascript:alert(1))
    # - 其他恶意协议
    if [[ ! "$url" =~ ^https?://[a-zA-Z0-9.-]+/.*\.pdf$ ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/MinerU_在线文档解析完整流程.md (reported line 240)May include surrounding context.

md

# 安全检查: 验证 URL 格式
    # 必须以 http:// 或 https:// 开头，以 .pdf 结尾
    # 这可以防止：
    # - 文件协议攻击 (file:///etc/passwd)
    # - JavaScript 协议攻击 (javascript:alert(1))
    # - 其他恶意协议
    if [[ ! "$url" =~ ^https?://[a-zA-Z0-9.-]+/.*\.pdf$ ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/MinerU_本地文档解析完整流程.md (reported line 272)May include surrounding context.

md

# 安全检查: 验证 URL 格式
    # 必须以 http:// 或 https:// 开头，以 .pdf 结尾
    # 这可以防止：
    # - 文件协议攻击 (file:///etc/passwd)
    # - JavaScript 协议攻击 (javascript:alert(1))
    # - 其他恶意协议
    if [[ ! "$url" =~ ^https?://[a-zA-Z0-9.-]+/.*\.pdf$ ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/Online_URL_Parsing_Guide.md (reported line 218)May include surrounding context.

md

# 安全检查: 验证 URL 格式
    # 必须以 http:// 或 https:// 开头，以 .pdf 结尾
    # 这可以防止：
    # - 文件协议攻击 (file:///etc/passwd)
    # - JavaScript 协议攻击 (javascript:alert(1))
    # - 其他恶意协议
    if [[ ! "$url" =~ ^https?://[a-zA-Z0-9.-]+/.*\.pdf$ ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/Online_URL_Parsing_Guide.md (reported line 241)May include surrounding context.

md

# 安全检查: 验证 URL 格式
    # 必须以 http:// 或 https:// 开头，以 .pdf 结尾
    # 这可以防止：
    # - 文件协议攻击 (file:///etc/passwd)
    # - JavaScript 协议攻击 (javascript:alert(1))
    # - 其他恶意协议
    if [[ ! "$url" =~ ^https?://[a-zA-Z0-9.-]+/.*\.pdf$ ]]; then

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/Local_File_Parsing_Guide.md (reported line 508)May include surrounding context.

md

# 安全: 解压前验证 ZIP 文件
if ! unzip -t "${OUTPUT_DIR}/result.zip" &>/dev/null; then
    echo "❌ 错误: 无效的 ZIP 文件"
    rm -f "${OUTPUT_DIR}/result.zip"
    exit 1
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/MinerU_在线文档解析完整流程.md (reported line 447)May include surrounding context.

md

# 安全: 解压前验证 ZIP 文件
if ! unzip -t "${OUTPUT_DIR}/result.zip" &>/dev/null; then
    echo "❌ 错误: 无效的 ZIP 文件"
    rm -f "${OUTPUT_DIR}/result.zip"
    exit 1
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/MinerU_本地文档解析完整流程.md (reported line 510)May include surrounding context.

md

# 安全: 解压前验证 ZIP 文件
if ! unzip -t "${OUTPUT_DIR}/result.zip" &>/dev/null; then
    echo "❌ 错误: 无效的 ZIP 文件"
    rm -f "${OUTPUT_DIR}/result.zip"
    exit 1
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/Online_URL_Parsing_Guide.md (reported line 448)May include surrounding context.

md

# 安全: 解压前验证 ZIP 文件
if ! unzip -t "${OUTPUT_DIR}/result.zip" &>/dev/null; then
    echo "❌ 错误: 无效的 ZIP 文件"
    rm -f "${OUTPUT_DIR}/result.zip"
    exit 1
fi

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/local_file_step1_apply_upload_url.sh (reported line 94)May include surrounding context.

sh

}"
fi

RESPONSE=$(curl -s -X POST "${MINERU_BASE_URL}/file-urls/batch" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer ${MINERU_TOKEN}" \
    -d "$JSON_PAYLOAD")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/online_file_step1_submit_task.sh (reported line 95)May include surrounding context.

sh

}"
fi

RESPONSE=$(curl -s -X POST "${MINERU_BASE_URL}/extract/task" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer ${MINERU_TOKEN}" \
    -d "$JSON_PAYLOAD")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documents shell-based scripts and network/file-handling behavior but does not declare any tool scope such as permissions or allowed-tools. That omission can cause users or agent runtimes to execute shell actions with broader-than-expected capability, reducing transparency and weakening least-privilege controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages uploading local PDFs and submitting remote PDF URLs to the external MinerU service but does not prominently warn that document contents and metadata are disclosed to a third party. In this context, users may process sensitive internal documents and unintentionally exfiltrate confidential data outside their trust boundary.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation asserts that the skill includes input validation, sanitization, and protections against JSON injection and directory traversal, but this file does not substantiate those claims. Unverified security claims can mislead users into trusting unsafe inputs or outputs, increasing the chance that downstream script usage handles attacker-controlled paths, URLs, or JSON unsafely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to upload local PDFs to a third-party MinerU service but does not prominently warn that document contents are being transmitted off-host to an external provider. Users may unknowingly send sensitive or regulated documents, creating confidentiality, privacy, and compliance risk in a skill specifically designed for document extraction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Lines L322-L323 assert that the skill contains input validation, sanitization, and extra security checks. In the provided file, these are blanket security claims about the implementation rather than observable behavior, creating an intent/documentation divergence unless the underlying scripts demonstrably implement them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document presents local PDF parsing as a normal workflow but does not clearly warn that the file contents are transmitted to a third-party remote API. Users may unknowingly upload sensitive local documents, creating confidentiality, compliance, and retention risks that are especially relevant for enterprise or regulated data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This command initiates a workflow that sends metadata and authorizes upload of a local document to a remote service using a bearer token, but the guide does not contextualize the security/privacy implications. In this skill's context, external transmission is expected functionality, yet it still represents a real risk because users may disclose sensitive local data to a third party without clear warning.

Content

Scanner excerpt · docs/Local_File_Parsing_Guide.md (reported line 40)May include surrounding context.

Command:

bash

curl -s -X POST "${MINERU_BASE_URL}/file-urls/batch" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer ${MINERU_TOKEN}" \
    -d '{

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide hard-codes the language parameter to ch in the API example, which imposes a specific locale choice rather than offering a user-selected option. This is a natural-language policy concern because the document presents the setting as the default workflow rather than documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The upload and result-download steps operationalize external transfer of document contents and processed outputs without an explicit user-facing warning about remote processing and retention implications. This increases the chance that operators handle confidential PDFs under the false assumption that processing is purely local.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

Downloading the result ZIP from a remote URL is inherent to the service design, but it is still an external data transfer and can expose processed content to third-party infrastructure. Combined with subsequent extraction, it also expands trust to remotely supplied artifacts that may be malicious if the service or distribution path is compromised.

Content

Scanner excerpt · docs/Local_File_Parsing_Guide.md (reported line 169)May include surrounding context.

Command:

bash

# Download ZIP package
curl -L -o "result.zip" \
  "YOUR_FULL_ZIP_URL_FROM_STEP3"

# Extract to folder

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Within the embedded shell script, the JSON payload sets language to ch both in the jq path and the fallback string payload. This forces a locale choice without opt-in and is not justified in the surrounding documentation as a region-specific or compliance-driven restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The scripted POST request automates transmission to a third-party API and uses a bearer token from the environment, but the guide frames this as routine without a clear privacy/security notice. In a local-file skill, this is materially relevant because users may believe the operation is local when it is not.

Content

Scanner excerpt · docs/Local_File_Parsing_Guide.md (reported line 387)May include surrounding context.

md

fi

# Send request to MinerU API
STEP1_RESPONSE=$(curl -s -X POST "${MINERU_BASE_URL}/file-urls/batch" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer ${MINERU_TOKEN}" \
    -d "$JSON_PAYLOAD")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The script downloads a remote ZIP result and then processes it locally, making the host trust externally provided content. Even with hostname validation and unzip -t, a compromised upstream could still deliver a harmful archive, so this is a meaningful supply-chain and data-transfer risk in context.

Content

Scanner excerpt · docs/Local_File_Parsing_Guide.md (reported line 502)May include surrounding context.

md

mkdir -p "$OUTPUT_DIR"

# Download result ZIP
curl -L -o "${OUTPUT_DIR}/result.zip" "$ZIP_URL"

# SECURITY: Validate ZIP file before extraction
# Prevents extraction of malicious or corrupted archives

Static analysis

No suspicious patterns detected.