mineru precision extract PDF、Document、Images

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:12 AM UTC
• Version: 0.2.1

Overview

This skill appears purpose-built for document extraction, but it needs careful review because it can send local documents to an external API while storing tokens and outputs locally.

Install only if you trust the MinerU service and package source. Avoid confidential, regulated, or proprietary documents unless you understand where they are processed, use an explicit output directory, protect or remove stored tokens, and consider pinning or separately verifying the CLI package before global installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:44

Finding

Unpinned Global Installation of Mutable Third-Party CLI Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21, SKILL.md:44-50, and SKILL.md:252-256
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: High

The Skill directs users to install mineru-open-api globally from npm or directly from the latest revision exposed through the Go package source. No immutable version, checksum, signature, or other integrity control is specified.

yaml

metadata: {"openclaw":{"emoji":"📄","homepage":"https://mineru.net","source":"https://github.com/MinerU-Extract/mineru-precision-extract","author":"OpenDataLab","requires":{"bins":["mineru-open-api"],"env":["MINERU_TOKEN"],"config":["~/.mineru/config.yaml"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}}

bash

npm install -g mineru-open-api

bash

go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

The upgrade instructions also explicitly request the latest mutable npm release:

bash

npm install -g mineru-open-api@latest

Technical Analysis

Installing a package without an immutable version allows the installed executable and its transitive dependencies to change after the Skill has been reviewed. The @latest selector explicitly resolves to whatever release the publisher or registry currently exposes.

Both installation mechanisms compile or install executable third-party content. Global npm installation may also run package lifecycle scripts. Consequently, compromise of the package publisher, registry account, source repository, release process, or a transitive dependency could turn a legitimate installation instruction into arbitrary local code execution.

The project metadata identifies the ...[truncated 1554 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin npm and Go installations to specific, reviewed versions rather than using an unversioned package or @latest.
2. Use npm lockfiles or equivalent reproducible dependency controls where installation architecture permits.
3. Publish and verify cryptographic checksums or signed release artifacts before installation.
4. Document the expected package publisher, repository, version, and integrity value so users can detect dependency confusion or repository substitution.
5. Avoid global installation where possible. Run the CLI in a dedicated virtual environment, container, or restricted user context.
6. Review package lifecycle scripts and transitive dependency changes before approving upgrades.
7. Replace the automatic “upgrade to latest” instruction with a controlled process that pins a reviewed release.
8. Do not perform installation with administrative privileges unless it is strictly required.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:61

Finding

Sensitive Documents May Be Uploaded Without an Explicit Disclosure and Consent Gate

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:61-68, SKILL.md:99-117, SKILL.md:209-211, and SKILL.md:223-229
Vulnerability Type: Insufficient safeguards around external transmission of sensitive data
Risk Level: Medium

The Skill uses an authenticated external API to process local documents, including files supplied directly or through standard input:

bash

mineru-open-api auth                         # Interactive token setup
export MINERU_TOKEN="your-token"             # Or set via environment variable

text

Token resolution order: `--token` flag > `MINERU_TOKEN` env > `~/.mineru/config.yaml`.

bash

mineru-open-api extract report.pdf                         # Markdown to stdout
mineru-open-api extract report.pdf -f html                 # HTML to stdout
mineru-open-api extract report.pdf -o ./out/               # Save to directory
mineru-open-api extract report.pdf -o ./out/ -f md,docx    # Multiple formats
mineru-open-api extract report.pdf -f latex -o ./out/      # LaTeX output
mineru-open-api extract report.pdf --model vlm -o ./out/   # High-accuracy mode
mineru-open-api extract report.pdf --ocr -o ./out/         # OCR for scanned docs
mineru-open-api extract report.pdf --language en -o ./out/ # Specify language
mineru-open-api extract report.pdf --pages "1-10" -o ./out/  # Page range
mineru-open-api extract *.pdf -o ./results/                # Batch extract
mineru-open-api extract --list files.txt -o ./results/     # Batch from file list
mineru-open-api extract https://example.com/doc.pdf        # Extract from URL
cat doc.pdf | mineru-open-api extract --stdin -o ./out/    # From stdin

The CLI also permits selection of a custom API endpoint:

markdown

| `--token` | | API token (overrides env and config) |
| `--base-url` | | API base URL (for private deployments) |
| `--verbose` | `-v` | Verbose mode, print HTTP details |

Technical

...[truncated 2513 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly state that local files and standard-input content are uploaded to a remote processing service.
2. Require informed user confirmation before the first upload and whenever an input may contain sensitive or regulated data.
3. Display the effective API destination before submission and use an allowlist for approved service domains.
4. Require separate confirmation for custom --base-url values and reject non-HTTPS endpoints.
5. Ensure the CLI never forwards a production token to an endpoint other than the token's intended origin. Use endpoint-specific credentials for private deployments.
6. Recommend redaction, page-range restriction, or removal of unnecessary attachments before upload to minimize transmitted data.
7. Offer or document a local-processing alternative for confidential documents when available.
8. Avoid placing tokens directly on command lines because process listings and shell history may expose them. Prefer protected configuration or environment-based secret injection.
9. Restrict permissions on ~/.mineru/config.yaml and ensure verbose HTTP logging redacts authorization headers and sensitive request bodies.
10. Document the external processor's retention, privacy, geographic-processing, and deletion policies so users can make an informed decision.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill repeatedly instructs users to submit local documents, remote files, and crawled web pages to mineru-open-api, but it does not clearly disclose that this processing is performed by a remote API service using an authentication token. Users may assume processing is local and inadvertently send sensitive PDFs, scans, or URLs containing private content to a third-party service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The skill encourages persistent credential configuration through interactive auth, environment variables, and config files, which introduces session persistence and increases the chance that long-lived API tokens remain accessible in shell history, environment inspection, or local config storage. While common for CLI tools, this still creates a meaningful exposure if the host or user session is compromised.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Authentication

Create a token at https://mineru.net/apiManage/token, then configure:

bash

mineru-open-api auth                         # Interactive token setup

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents auto-generated output directories and notes that extracted images are saved alongside Markdown, but it does not present this as a user-facing safety warning. This can lead to unexpected persistence of extracted sensitive content on disk, especially when default output paths are generated automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.