Back to skill

Security audit

Mineru Pdf Parser

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed MinerU PDF-to-Markdown integration, but users should only use it with documents they are comfortable sending to MinerU.

Install only if you trust MinerU with the PDFs you process and with your MINERU_TOKEN. Avoid using the paper-workflow auto invocation on sensitive, regulated, or internal documents unless you have approval, and treat the saved results under ~/.openclaw/MinerU_Results as local copies that may need cleanup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'url' from requests.post (line 207, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
os.makedirs(out_dir, exist_ok=True)
    
    print(f"📥 下载...")
    r = requests.get(url, stream=True)
    with open(zip_path, "wb") as f:
        for c in r.iter_content(8192):
            f.write(c)
Confidence
96% confidence
Finding
r = requests.get(url, stream=True)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill clearly requires environment access to read MINERU_TOKEN and network access to send PDFs and credentials to mineru.net, but those capabilities are not formally declared as permissions beyond metadata hints. Undeclared sensitive capabilities reduce transparency and can bypass user expectations or platform policy enforcement, especially because the skill transmits both authentication material and document content to a third party.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger phrase "将 PDF 转为 Markdown" is broad enough to match ordinary user requests that do not imply consent to upload files to an external service. In this skill's context, accidental invocation is more dangerous because activation can cause private PDF contents to be sent to mineru.net along with use of a stored API token.

Missing User Warnings

High
Confidence
96% confidence
Finding
The description advertises local-file and online-URL parsing but does not prominently warn, at trigger/selection time, that document contents may be transmitted to a third-party service for processing. This is a significant data-handling risk because users may provide academic papers, internal documents, or other sensitive PDFs without realizing the content leaves the local environment.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill uploads local PDF files to `mineru.net` for processing, but the code does not present a clear, unavoidable user-facing warning or explicit consent gate at upload time. In an agent context, users may believe processing is local, so sensitive documents could be transmitted off-device unexpectedly.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.