Security audit

Mineru Pdf

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent PDF parsing tool, but it asks users to run mutable third-party code and includes an unsafe test script that can turn parameters into executable Python.

Review carefully before installing. Use only with documents you are authorized to process, avoid running test.sh with untrusted arguments, and prefer a pinned, reviewed mcp-mineru version in an isolated environment before parsing sensitive files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:21
Finding: Unpinned Third-Party Package Is Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: test.sh:4
Finding: Arbitrary Python Code Injection Through Test Script Arguments
Content: View full analysis
Remediation: View remediation
&2 exit 2 fi if [[ ! "$END_PAGE" =~ ^-?[0-9]+$ ]]; then echo "Invalid end page" >&2 exit 2 fi uvx --from 'mcp-mineru==REVIEWED_VERSION' python - \ "$PDF_FILE" "$START_PAGE" "$END_PAGE" <<'PY' import asyncio import sys from mcp_mineru.server import call_tool pdf_file = sys.argv[1] start_page = int(sys.argv[2]) end_page = int(sys.argv[3]) async def parse_pdf(): result = await call_tool( name="parse_pdf", arguments={ "file_path": pdf_file, "backend": "pipeline", "formula_enable": True, "table_enable": True, "start_page": start_page, "end_page": end_page, }, ) if hasattr(result, "content"): for item in result.content: if hasattr(item, "text"): print(item.text) break asyncio.run(parse_pdf()) PY ``` Additional hardening measures: 1. Enable `set -euo pipefail` to fail on unset variables and command errors. 2. Enforce non-negative page ranges or the explicitly supported sentinel value. 3. Verify that the start page does not exceed the end page when an end page is supplied. 4. Validate that the input path refers to an expected regular PDF file. 5. Add regression tests containing quotes, newlines, Python expressions, and shell metacharacters to confirm that arguments remain data rather than executable source. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.
bash
# Capture to file claude -p "Parse this PDF: /path/to/file.pdf" > /tmp/output.md # Or use within a script that saves the result

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents commands that read arbitrary local files and write extracted output, but it does not declare any permissions or allowed-tools scope. That omission can cause users or hosting systems to underestimate the file-system access the skill requires, increasing the chance of overbroad or implicit access to sensitive documents.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The command installs or runs an MCP server from an unpinned package reference, so the exact code executed can change over time. If the upstream package is compromised or a breaking release is published, users may execute malicious or unsafe code simply by following the documented command.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This example invokes code from an unpinned mcp-mineru package, making execution dependent on whatever version is current at runtime. That creates a supply-chain risk because a malicious or vulnerable upstream release would be trusted automatically.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Using uvx --from mcp-mineru without a fixed version allows silent drift in the code being executed. In a skill that processes local files, supply-chain compromise could expose document contents or lead to arbitrary code execution in the user's environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The example relies on an unpinned external package, so users cannot reproduce or audit the exact code path being run. Because the skill handles local documents and may download models, compromise of the package could affect both confidentiality and system integrity.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This invocation pulls and runs mcp-mineru without version pinning, exposing users to upstream tampering or unsafe updates. The risk is amplified because the tool is intended to parse local content and may have broad file access in practice.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: An unpinned package execution path means the command may run materially different code at different times. That is a real supply-chain vulnerability, especially for a skill that users may run against sensitive PDFs and images.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The troubleshooting instruction still recommends an unpinned package invocation, so even recovery steps direct users toward non-reproducible code execution. Attackers often benefit from these copy-pasted operational commands because users trust them during setup and debugging.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.
md
### Why Files Get Deleted (MCP Method) The MinerU MCP server uses Python's `tempfile.TemporaryDirectory()`, which automatically deletes files when the context exits. This is by design to prevent temporary files from accumulating. ### How to Preserve Files

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code hard-codes p_lang_list=["ch", "en"], which imposes a specific language/locale behavior on all users. This matches the policy concern for language or locale constraints when the skill does not offer a user-selectable option or clearly justify the restriction.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The script invokes uvx --from mcp-mineru without pinning an exact package version, so execution depends on whatever version is currently resolved from the package source. This creates a supply-chain risk: a compromised, typosquatted, or unexpectedly updated package could execute arbitrary code when the test script runs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file instructs users to run PDF parsing on local documents and highlights extracted text, tables, and formulas, but it does not include any warning that input documents may contain sensitive or personal data. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation explicitly states that models are downloaded on first use, which implies network activity and possible transfer of environment metadata such as IP address or package access patterns. Under SQP-2 for markdown files, network-related behavior that may affect privacy or system integrity should be disclosed with a user warning.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description and top-level documentation consistently frame the skill as a PDF parser focused on PDF documents. However, the supported formats section broadens the capability to JPEG, PNG, and other image formats, which is a semantic expansion beyond the stated manifest scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.