PDF to HTML

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:33 PM UTC
• Version:
  0.4.0

Overview

This is a straightforward PDF-to-HTML helper for MinerU, with normal external CLI and token risks but no hidden or destructive behavior in the artifact.

Install only if you are comfortable trusting the MinerU CLI package and service. Use a dedicated MINERU_TOKEN, avoid putting the token in shared files or logs, and do not process confidential, regulated, or credential-bearing PDFs unless your organization approves sending them through MinerU.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly supports token-based extraction and URL inputs, but it does not warn users that document contents or fetched remote PDFs may be transmitted to an external MinerU service. This can lead to unintended disclosure of sensitive documents, credentials embedded in URLs, or regulated data, especially because users may assume a local-only conversion workflow from the CLI examples.

VirusTotal

63/63 vendors flagged this skill as clean.