MiniMax PDF Analysis V2

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:09 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches PDF analysis, but it also ships an undeclared MiniMax web search and generic image-upload tool, and remote document upload is not clearly warned about.

Review this skill before installing if you work with confidential PDFs. Vision mode sends page images and prompts to MiniMax, and the package also includes an undeclared web search and generic local-image upload helper. Use only with documents you are allowed to send to that third-party API, and avoid exposing broad local file paths or sensitive images unless you explicitly intend that upload.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description claims a MiniMax API-based PDF analysis tool with multiple capabilities: text extraction, keyword search, and image-based VLM analysis. The supplied code only opens a local PDF with PyMuPDF and extracts plain text from selected pages. It does not call any external API, does not require or use a MiniMax API key, does not search for keywords, and does not convert pages to images or perform VLM analysis. This is a material mismatch in both primary purpose and implemented capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description centers on PDF analysis workflows: reading PDFs, extracting text, searching keywords within documents, and converting PDF pages to images for VLM analysis. The code does none of that. Instead, it exposes a web search capability using MiniMax's coding plan search API and an image understanding capability that accepts either remote image URLs or local image files (.jpg/.png/.gif/.webp). There is no PDF handling library, no PDF text extraction, no page rendering/conversion, and no document-scoped keyword search. The required API key format is consistent with the description, but the primary purpose and actual capabilities are materially different.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This code chunk implements only PDF page rendering to image files. While image conversion is mentioned in the description as a preparatory step for VLM analysis, the declared purpose emphasizes PDF analysis using the MiniMax API with text extraction, keyword search, and image-based analysis. None of those analysis or API behaviors are present here. Therefore the actual behavior is materially narrower and different from the declared purpose, making this a description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a MiniMax API-powered PDF analysis tool with multiple capabilities: text extraction, keyword search, and image-based visual-language analysis via page-to-image conversion. The provided code only implements one narrow local feature: searching extracted text in a PDF and printing snippets. It does not call any external API, does not require or use a MiniMax API key, does not convert pages to images, and does not perform VLM analysis. While keyword search overlaps with the description, the primary described mechanism and several major capabilities are absent, so the description does not accurately represent the actual behavior.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implementation exposes a general web search capability even though the skill is presented as a PDF-analysis tool. Scope mismatch is dangerous because users and orchestrators may grant this skill access or trust under the assumption that it only processes PDFs, while it actually enables external data retrieval and broader model interaction than advertised.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The code does not implement the promised PDF extraction or PDF-to-image workflow, and instead provides unrelated search and generic image-analysis behavior. This capability deception can cause an agent platform or user to invoke the skill under false assumptions, creating an opportunity for unauthorized data handling and bypass of least-privilege or review expectations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README advertises VLM analysis through the MiniMax API but does not clearly disclose that PDF page contents are rendered to images and sent to an external service. Users may unknowingly transmit sensitive document contents off-system, creating confidentiality, compliance, and data-handling risks, especially for internal, regulated, or customer documents.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Vision mode examples encourage direct use of remote image analysis without warning that selected PDF pages are converted to PNGs and analyzed by a third-party API. This increases the chance that users will copy-paste commands against confidential PDFs without informed consent about external transmission and retention implications.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill metadata declares required binaries and an environment variable but does not declare any explicit tool scope or permissions, even though the documented behavior implies shell execution, file operations, environment access, and network use. This weakens reviewability and least-privilege controls, making it easier for a skill to access sensitive resources without clear user/operator awareness.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to run a vision mode that sends PDF-derived page images to the MiniMax API, but it does not clearly warn that document content leaves the local environment for third-party processing. Users may unintentionally upload sensitive, regulated, or proprietary PDF contents, creating confidentiality and compliance risks.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["--output", output])
    if pages:
        cmd.extend(["--pages", pages])
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout, result.stderr, result.returncode

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["--output", output])
    if pages:
        cmd.extend(["--pages", pages])
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout, result.stderr, result.returncode

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        conv_script = Path(__file__).parent / "pdf_to_images.py"
        page_arg = ["--pages", pages] if pages else []
        conv_result = subprocess.run(
            [sys.executable, str(conv_script), str(pdf_path), str(tmp_dir),
             "--dpi", str(dpi)] + page_arg,
            capture_output=True, text=True

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The vision mode transmits PDF-derived page images and the user prompt to a third-party API, which can expose sensitive document contents outside the local environment. Although this is part of the feature's purpose, the code provides no explicit runtime warning, confirmation, redaction option, or clear consent gate before sending potentially confidential data.

External Transmission

Medium

• Category: Data Exfiltration

Content

"image_url": f"data:image/png;base64,{img_b64}"
            }).encode()
            req = urllib.request.Request(
                "https://api.minimax.io/v1/coding_plan/vlm",
                data=data,
                headers={
                    "Authorization": f"Bearer {api_key}",

• Confidence: 92% confidence
• Finding: The code sends base64-encoded PDF page images and prompts to an external MiniMax endpoint, creating a real data-exfiltration boundary. In the context of a PDF analysis skill, remote processing may be expected, but it still becomes dangerous when users analyze sensitive or regulated documents without strong disclosure and consent controls.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module documentation advertises web search and image understanding capabilities that contradict the stated PDF-analysis purpose of the skill. While documentation mismatch alone is not code execution, in an agent ecosystem it is a security-relevant trust issue because it signals undeclared capabilities and increases the chance of misuse or hidden data flows.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The image-analysis path reads a local file, base64-encodes it, and sends it to a remote MiniMax API, but the user-facing interface does not prominently warn that local file contents will leave the host. In an agent setting this is dangerous because a caller may treat local-path input as local-only processing and inadvertently exfiltrate sensitive documents or screenshots to a third party.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The natural-language instructions from L09 onward are presented in Chinese, which can amount to a language policy issue if users are not given an opt-in or alternative locale. There is no indication that the skill is intentionally region-specific or that other language options are available.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The module docstring, usage descriptions, and CLI help strings are presented in Chinese only, which imposes a specific language on users without opt-in. Under the stated policy, forcing a language or locale without offering a choice is a natural-language policy violation.

Static analysis

No suspicious patterns detected.