Doc to JSON

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:41 AM UTC
• Version: 1.0.0

Overview

This document converter is purpose-aligned but needs review because it can send user documents to MinerU and passes the MinerU token through process arguments without clear opt-in guidance.

Review before installing if you may process confidential documents. Use it only for files you are comfortable sending through MinerU, verify MinerU's data-handling terms, and prefer changing the script so the token is supplied through a safer supported mechanism instead of a command-line argument.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/doc_to_json.py:25

Finding

MinerU API Token Exposed Through Process Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/doc_to_json.py, lines 25–35
Vulnerability Type: Credential exposure through command-line arguments
Risk Level: Medium

Vulnerable Code

python

def run_mineru(input_file: str, temp_dir: str) -> str:
    """Run mineru-open-api to convert document to Markdown."""
    output_dir = os.path.join(temp_dir, "mineru_out")
    os.makedirs(output_dir, exist_ok=True)

    cmd = [
        "mineru-open-api",
        "extract",
        "--token", os.environ.get("MINERU_TOKEN", ""),
        input_file,
        "-o", output_dir
    ]

    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)

Technical Analysis

The script reads MINERU_TOKEN from the environment but then places its value directly in the child process argument vector through the --token option. Command-line arguments may be exposed through process-inspection facilities, process telemetry, audit systems, diagnostic tools, or logs.

Consequently, another local account or monitoring component with permission to observe the MinerU process may recover the credential while extraction is running. Passing arguments as a list prevents shell command injection, but it does not protect secrets contained in those arguments.

The practical exploitability depends on the operating system's process visibility controls and the permissions of the observing user. No remote exploitation path is established by the reviewed code.

Attack Path

1. A user configures a valid MINERU_TOKEN and invokes scripts/doc_to_json.py.
2. The script reads the secret from the environment.
3. It launches mineru-open-api with --token <secret> in its process arguments.
4. During the child process lifetime, a local attacker or telemetry component able to inspect process arguments records the command line.
5. The attacker extracts and reuses the token against services accessible with that credential.

Impact Assessment

Successful expl ...[truncated 476 chars]

Remediation

View remediation

Remediation Suggestions

• Do not include credentials in the child process argument vector.
• Prefer allowing mineru-open-api to read MINERU_TOKEN directly from its inherited environment, if supported.
• If environment-based authentication is unavailable, use a protected credential file or standard-input mechanism supported by MinerU. Ensure any credential file has restrictive permissions and is securely removed after use.
• Validate that MINERU_TOKEN is present before invoking the CLI and return a clear error without printing the token.
• Review process-monitoring, audit, and application logs to ensure credentials from prior executions were not retained.
• Rotate any token that may already have been exposed through process inspection or telemetry.
• Document that MinerU is an external extraction service and warn users not to submit sensitive documents until they have verified its endpoint and data-handling policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and instructs use of shell commands, environment variables, and file read/write behavior, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where an agent may invoke powerful capabilities without clear user-visible restrictions, increasing the chance of unintended command execution, filesystem access, or secret exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes broad and generic phrases such as document parsing and JSON conversion terms, which can cause the skill to activate in situations the user did not intend. In this skill's context, accidental invocation is more dangerous because activation may lead to local file handling and transmission of document content to an external extraction service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill describes document conversion via MinerU but does not clearly disclose that user documents are sent to an external extraction service. This omission can lead users or agents to process sensitive files under the false assumption of local-only handling, creating privacy, confidentiality, and compliance risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/doc_to_json.py (reported line 38)May include surrounding context.

python

"-o", output_dir
    ]

    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    if result.returncode != 0:
        raise RuntimeError(f"MinerU failed: {result.stderr}")

Tainted flow: 'cmd' from os.environ.get (line 30, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/doc_to_json.py (reported line 38)May include surrounding context.

python

"-o", output_dir
    ]

    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    if result.returncode != 0:
        raise RuntimeError(f"MinerU failed: {result.stderr}")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The parser only recognizes Chinese metadata keys such as 课程名称, 课程代码, and related labels, which effectively forces a specific locale in the skill's behavior. There is no user opt-in, language selection, or documented justification that this is a region-specific tool, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file includes Chinese-only trigger phrases and hard-coded output structure examples such as section markers "一、二、三..." and the key "表格" without stating that the skill is intended only for Chinese-language documents. This can amount to an implicit locale restriction without offering user choice or documenting the limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The sample logic hard-codes Chinese keys like "表格" and "列表", and the surrounding text does not explain that the pattern is intended only for Chinese-structured input or offer any locale flexibility. This creates a natural-language locale assumption that may conflict with policies requiring explicit language or locale choice unless the regional constraint is documented.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.