MiniMax PDF OCR

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:01 PM UTC
• Version: 1.0.0

Overview

This OCR skill mostly matches its stated purpose, but it has a real local command-injection risk and asks users to install unnecessary packages.

Review before installing. Only use this skill on documents you are comfortable sending to MiniMax, avoid sensitive PDFs unless external OCR is approved, and fix the pdftoppm spawn call to disable shell execution before using it on files or paths from other people. The npm install instruction should also be removed or corrected so users do not install unused packages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: pdf-ocr-minimax.js:26

Finding

Shell Command Injection Through User-Controlled File Paths

Content

View full analysis

Vulnerability Details

File Location: pdf-ocr-minimax.js:26-32
Vulnerability Type: OS command injection caused by unnecessary shell invocation
Risk Level: High

Vulnerable Code

javascript

return new Promise((resolve, reject) => {
  const proc = spawn('pdftoppm', [
    '-png',
    '-r', '200',
    '-singlefile',
    pdfPath,
    path.join(imageDir, 'page')
  ], { shell: true });

Technical Analysis

The pdfPath value originates from the first command-line argument, while imageDir is derived from the user-selected output directory and the input filename. These values are passed to child_process.spawn() with shell: true.

Enabling shell processing is unnecessary for invoking the fixed pdftoppm executable. It can cause shell metacharacters contained in a valid input filename or output directory to be interpreted as command syntax rather than literal path characters. The earlier fs.existsSync(pdfPath) check does not prevent exploitation because Unix-like filesystems permit shell metacharacters in filenames.

Consequently, a maliciously crafted path can cross the intended data boundary and become executable shell syntax.

Attack Path

1. An attacker creates or supplies a PDF whose filename contains shell metacharacters and an injected command.
2. The attacker persuades the user or Agent to process that file, or otherwise controls the input or output path passed to the CLI.
3. The file existence check succeeds because the maliciously named file exists.
4. pdfToImages() passes the attacker-influenced path to spawn() with shell: true.
5. The shell interprets the embedded syntax and executes the injected command in addition to, or instead of, the intended pdftoppm operation.

Impact Assessment

Successful exploitation permits arbitrary command execution with the privileges of the user or Agent running the Skill. Depending on those privileges, an attacker could r ...[truncated 334 chars]

Remediation

View remediation

Remediation Suggestions

• Remove shell: true and invoke pdftoppm directly:

  javascript

  const proc = spawn('pdftoppm', [
    '-png',
    '-r', '200',
    '-singlefile',
    pdfPath,
    path.join(imageDir, 'page')
  ], {
    shell: false,
    stdio: ['ignore', 'pipe', 'pipe']
  });
  

• Resolve and validate input and output paths before use.

• Verify that the input is a regular file and enforce the expected PDF file type.

• Reject unexpected conversion exit codes rather than resolving regardless of process failure.

• Capture and safely report stderr without incorporating it into another command.

• Run the Skill under a minimally privileged account with access limited to the required input and output locations.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Documentation Instructs Installation of Unused and Unpinned Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21-25
Vulnerability Type: Unnecessary third-party dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

bash

# Install Node.js dependencies
cd minimax-pdf-ocr
npm install openai pdf2image

The project manifest simultaneously declares no dependencies:

json

"dependencies": {}

Technical Analysis

The implementation does not import either openai or pdf2image. It uses Node.js built-in modules, the global fetch() implementation available in the declared Node.js version, and the external pdftoppm executable.

Directing users to install unused packages expands the project’s supply-chain attack surface beyond what is necessary for its declared OCR functionality. The command does not pin exact package versions or use a reviewed lockfile. Package installation may download transitive dependencies and execute package lifecycle scripts under the installing user’s authority.

No evidence establishes that the named packages are currently malicious. The security issue is the unnecessary, mutable, and undocumented trust introduced by requiring installation of code that the Skill does not use.

Attack Path

1. A user follows the installation instructions in SKILL.md.
2. npm resolves the latest versions permitted by the package names at installation time, including their transitive dependencies.
3. npm downloads those packages and may execute applicable lifecycle scripts.
4. If any package, release, maintainer account, or transitive dependency is compromised, malicious installation code can execute in the user’s environment.
5. The resulting access is unnecessary because neither dependency is required by the audited implementation.

Impact Assessment

A compromised dependency or installation script could execute with the privileges of the user running npm install. This could expose project files, user-access ...[truncated 327 chars]

Remediation

View remediation

Remediation Suggestions

• Remove npm install openai pdf2image from SKILL.md, because neither package is used.
• Document that the current JavaScript implementation has no npm dependencies.
• Retain only the required system dependency on pdftoppm/Poppler, with installation guidance appropriate to supported platforms.
• If npm dependencies are introduced later:
  • Declare them in package.json.
  • Pin reviewed versions.
  • Commit and review a lockfile.
  • Use npm ci for reproducible installation.
  • Audit transitive dependencies and lifecycle scripts before release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents use of environment variables and a third-party API, which implies access to secrets and network egress, but it does not declare any tool scope or permission boundaries. This can lead to overbroad execution in agent environments, where the skill may gain undeclared access to sensitive environment data or external connectivity without explicit user or platform approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explains OCR functionality but does not clearly warn that uploaded PDFs/images and their contents are transmitted to the MiniMax Vision API for processing. Users may unknowingly send sensitive documents, creating confidentiality and compliance risks, especially for personal, financial, legal, or internal business material.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The only natural-language description in the manifest is written in Chinese, which can impose a language-specific experience without any stated user opt-in or region-specific justification. Under the language/locale policy, fixed-language behavior should either offer choice or clearly document why the locale constraint is required.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes using the MiniMax Vision API to recognize text in PDFs/images, but the implementation also invokes the external pdftoppm program via child_process.spawn with shell execution. Running local subprocesses is a materially broader capability than simple OCR/API use and is not disclosed in the stated skill purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The hardcoded remote destination confirms that local document content is sent to a third-party domain, creating a confidentiality risk if users process private PDFs. In context this is likely intended functionality, but it still merits treatment as a real data-exposure issue because the service boundary is outside the local environment.

Content

Scanner excerpt · pdf-ocr-minimax.js (reported line 61)May include surrounding context.

js

const imageData = fs.readFileSync(imagePath);
  const base64Image = imageData.toString('base64');
  
  const response = await fetch('https://api.minimax.chat/v1/text/chatcompletion_v2', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The hardcoded remote destination confirms that local document content is sent to a third-party domain, creating a confidentiality risk if users process private PDFs. In context this is likely intended functionality, but it still merits treatment as a real data-exposure issue because the service boundary is outside the local environment.

Content

Scanner excerpt · pdf-ocr-minimax.js (reported line 61)May include surrounding context.

js

const imageData = fs.readFileSync(imagePath);
  const base64Image = imageData.toString('base64');
  
  const response = await fetch('https://api.minimax.chat/v1/text/chatcompletion_v2', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill transmits full page images derived from local PDFs to a third-party OCR endpoint, which may expose sensitive document contents to an external service without an explicit runtime warning or consent step. This is especially risky because users may process confidential PDFs and not realize the OCR is cloud-based rather than local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language description states that the skill supports Chinese and English, which can be interpreted as a locale/language limitation. Because the file does not offer a language choice or explain why the restriction is necessary, it may conflict with policy against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This manifest description states the skill's general purpose but provides no explicit activation phrases, scope limitations, or exclusion conditions. In a manifest file, that lack of specificity can contribute to overly broad or ambiguous invocation behavior if the description is used for routing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The code accesses process.env.MINIMAX_API_KEY to obtain credentials, but the manifest description only says the skill recognizes text in PDFs/images using MiniMax Vision API. While credentials may be operationally necessary, reading environment variables is still a capability not reflected in the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The embedded prompt instructs the model to recognize and output text including Chinese and English, imposing a specific language handling policy in natural language. There is no user opt-in or configurable locale/language selection documented in the script.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: pdf-ocr-minimax.js:36

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: pdf-ocr-minimax.js:14