ClawHub
Back to skill

Security audit

ade-mineru-api-skills

Security checks for vulnerabilities and agentic risk

Overview

The skill’s document-extraction purpose is coherent, but its install path asks users to execute mutable remote installer scripts without integrity verification.

Review this skill before installing. The main risk is not the mineru command wrapper itself, but the documented installer commands that execute remote scripts directly. Prefer a pinned, verifiable installer or inspect and verify downloads before running them. Also avoid sending confidential documents or internal URLs to the MinerU API unless that is acceptable for your data policy.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:15
Finding

Mutable Remote Installers Are Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
CONTRIBUTING.md:23
Finding

Contribution Workflow Repeats Unverified Remote Script Execution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The curl -fsSL .../install.sh | sh command fetches an external script and executes it immediately, creating a direct remote code execution path. Because this appears in contributor guidance, the skill context increases risk: readers are explicitly encouraged to run it locally while troubleshooting, so a compromised CDN, replaced script, or malicious redirect could execute arbitrary shell commands on their machine.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 26)May include surrounding context.

  1. Install the latest version:

    bash
    curl -fsSL https://cdn-mineru.openxlab.org.cn/open-api-cli/install.sh | sh

  2. Test the command in your terminal to isolate the issue:

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | sh shell pipe is the risky mechanism that turns a network fetch into immediate command execution, removing any review step and amplifying the danger of script substitution or tampering. In this skill's documentation context, it is especially risky because it is presented as a routine prerequisite, which normalizes unsafe copy-paste behavior for contributors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 26)May include surrounding context.

  1. Install the latest version:

    bash
    curl -fsSL https://cdn-mineru.openxlab.org.cn/open-api-cli/install.sh | sh

  2. Test the command in your terminal to isolate the issue:

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 55)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands or flags:

- Keep the Installation and Authentication sections current
- Add new commands in the correct category (extract/crawl/auth/status)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill instructs users to execute a remote shell script directly from the network with curl | sh. If the CDN, origin, DNS, TLS termination, or distribution pipeline is compromised, arbitrary code will run immediately on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Linux / macOS

bash
curl -fsSL https://cdn-mineru.openxlab.org.cn/open-api-cli/install.sh | sh

Windows (PowerShell)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The use of a shell pipeline to fetch and immediately execute remote content creates a chaining pattern that removes opportunities for validation, review, or integrity checks. In an agent context, this is especially dangerous because automated tooling may execute the command non-interactively, turning a documentation snippet into instant remote code execution.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Linux / macOS

bash
curl -fsSL https://cdn-mineru.openxlab.org.cn/open-api-cli/install.sh | sh

Windows (PowerShell)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document instructs contributors to install software by piping a remotely fetched script directly into sh, which executes unreviewed code from the network immediately. In a contributor-facing skill, this is dangerous because users may copy-paste it without inspecting the script, enabling compromise if the hosting endpoint, transport path, or upstream script is malicious or altered.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill repeatedly encourages extraction of local files, stdin content, remote documents, and crawled web pages via a third-party API, but does not clearly warn that document contents, URLs, and possibly embedded sensitive data are transmitted to MinerU servers. This can lead users or agents to exfiltrate confidential documents or internal URLs off-host without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file first documents that without -o, output goes to stdout and shows multiple examples of stdout-mode operation (L73, L84, L107, L190-L193). Later, the agent guidelines say the agent MUST generate a default output directory when the user does not specify -o, which changes the command's behavior from stdout streaming to file-writing. This is an active contradiction between the documentation's stated default behavior and the prescribed usage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation states that the language defaults to ch (Chinese), which imposes a specific locale behavior by default. The file does not present this as an opt-in choice or justified region-specific constraint, so it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.