MinerU zero-setup document extraction — convert PDFs, images, Word, and PowerPoint to Markdown instantly. No login, no token, no configuration. Just run and get results

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:12 AM UTC
• Version: 0.2.1

Overview

This document-extraction skill is coherent, but it under-explains sensitive document handling while installing and running an unpinned third-party CLI.

Review this before installing. Treat submitted documents, URLs, and extracted outputs as potentially sensitive. Use it only when you are comfortable with the MinerU/OpenDataLab CLI handling the file, prefer a pinned or sandboxed installation, and specify an explicit output directory for sensitive documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Unpinned Third-Party Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:36, SKILL.md:43-49, and SKILL.md:177
Vulnerability Type: Unpinned globally installed executable dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"⚡","homepage":"https://mineru.net","source":"https://github.com/MinerU-Extract/mineru-fast-extract","author":"OpenDataLab","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}}

bash

npm install -g mineru-open-api

bash

go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

bash

npm install -g mineru-open-api@latest

Technical Analysis

The skill directs users or agents to install the mineru-open-api executable from npm or a remote Go repository without pinning it to a reviewed immutable version. The Go installation and upgrade commands explicitly select @latest, while the ordinary npm installation implicitly resolves the latest available release.

Because the installed executable is subsequently authorized through the skill's allowed-tools configuration and processes user-supplied documents, its effective behavior is determined by package content retrieved after this skill was reviewed. A compromised registry account, repository, package release, or transitive dependency could therefore introduce attacker-controlled executable code without requiring any change to SKILL.md.

Global npm installation further increases exposure because package installation scripts can execute with the permissions of the user performing the installation. The reviewed file does not establish that the current package is malicious; the vulnerability is ...[truncated 1712 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin npm installations to a specifically reviewed version rather than resolving the latest release:

   bash

   npm install -g mineru-open-api@X.Y.Z
   

2. Pin Go installation to a reviewed semantic version or immutable commit rather than @latest:

   bash

   go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@vX.Y.Z
   

3. Update the skill metadata so its installation definitions identify the same reviewed versions used in the documentation.

4. Verify downloaded artifacts using publisher signatures, registry provenance, checksums, or an equivalent integrity mechanism before execution.

5. Review npm lifecycle scripts and transitive dependencies before approving each upgrade. Use lockfiles or a controlled internal mirror where the deployment model permits them.

6. Avoid automatic upgrades to latest. Establish a controlled process in which new releases are reviewed, tested in isolation, and then deliberately promoted.

7. Prefer a project-local or sandboxed installation over global installation. Run document processing with minimal filesystem and network permissions.

8. Document whether files are transmitted to a remote service and ensure sensitive documents are processed only after users understand and approve the relevant data-handling behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises support for remote URLs and a zero-setup external CLI, but does not warn that submitting a URL or document may send user-controlled or sensitive content to a third-party service. In this context, users may reasonably assume local-only processing, so the omission can lead to unintended disclosure of confidential documents, URLs, or metadata.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The read_when entries include generic phrases such as 'Parsing document content', 'Reading PDF files', and 'Fast document conversion' without clear boundaries or exclusion conditions. These broad triggers overlap with many common document-related tasks and could cause the skill to be invoked in situations where this specific MinerU extraction workflow is not actually intended.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation earlier states that without -o, extraction results go to stdout, but this later guidance instructs the agent to generate and use a default output directory when the user does not specify -o. Those two behaviors are mutually inconsistent, so the skill's instructions actively contradict themselves about whether output is written to stdout or to disk by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The 'Default output directory' section instructs the agent to generate and use ~/MinerU-Skill/<name>_<hash>/, which creates files and directories on the user's machine. The skill description does not explicitly warn users that running the skill may write extracted content and images to local storage, which may matter for sensitive documents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.