HTML to HTML

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:31 PM UTC
• Version:
  0.4.0

Overview

This skill is a disclosed MinerU HTML-cleanup helper that requires user-chosen inputs and a MinerU token, with no hidden code or automatic behavior found.

Install only if you intend to use MinerU for HTML cleanup. Do not process confidential, regulated, or proprietary pages or local HTML exports unless MinerU's data handling is acceptable for your use case, and handle MINERU_TOKEN like a secret.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill encourages users to submit remote URLs and local HTML files to a third-party MinerU service and notes that a token is required, but it does not clearly warn users that the referenced content is transmitted off-host for processing. This can mislead users into sending sensitive internal pages, scraped content, or local HTML exports to an external service without informed consent, creating confidentiality and compliance risk.

VirusTotal

63/63 vendors flagged this skill as clean.