Security audit

Doc to JSON

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it can send selected documents to MinerU and exposes the MinerU token on the command line, so users should review it before installing.

Install only if you are comfortable sending the chosen documents to MinerU and trusting the mineru-open-api CLI. Use a limited-purpose MinerU token, avoid confidential or regulated documents unless MinerU's handling terms are acceptable, and review generated JSON before feeding it into a knowledge base.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes shell commands, reads and writes files, and depends on an environment secret, but it does not declare permissions or capabilities explicitly. This creates a transparency and policy-enforcement gap: an agent or reviewer may approve or run the skill without understanding that it can access local files, write outputs, and transmit data through an external CLI using a token.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The trigger phrases are broad enough to match many ordinary document-processing requests, which can cause the skill to activate in situations where the user did not clearly consent to external processing. In this skill's context, overbroad activation is more dangerous because the workflow sends document contents to MinerU, potentially exposing sensitive files unexpectedly.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill describes document conversion but does not clearly warn that uploaded document contents are sent to MinerU via an external CLI/API. This omission undermines informed consent and can lead to unintentional disclosure of confidential, regulated, or proprietary document data to a third party.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The MinerU token is placed directly on the subprocess command line, which can be exposed to other local users through process listings, shell history wrappers, debugging tools, or audit logs. In an agent skill context, this is more dangerous because the skill may run in shared or managed environments where process metadata is observable.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This skill sends the user-supplied document to an external conversion tool/service without any explicit consent prompt or disclosure in the code path, which creates a data exfiltration and privacy risk. Because the skill is specifically for document conversion, users may provide sensitive reports, course materials, or internal files, making undisclosed external transmission materially risky.

Static analysis

No suspicious patterns detected.