Doc Analysis

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:56 AM UTC
• Version: 0.4.0

Overview

The skill is purpose-aligned for Word document analysis, but users should review it because it may send document contents to an external MinerU/OpenDataLab service without clearly warning about that data exposure.

Before installing, confirm you are allowed to process the target documents with MinerU/OpenDataLab and avoid submitting confidential, regulated, or private documents unless that data handling is acceptable. Prefer pinned, reviewed CLI versions and least-privilege token handling rather than broad global installation where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–17; related unversioned dependency declarations also appear on line 5
Vulnerability Type: Supply-chain risk caused by mutable dependency versions
Risk Level: Medium

bash

npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

The documented npm installation does not specify a reviewed package version, while the Go installation explicitly selects @latest. Both commands therefore resolve mutable upstream releases at installation time rather than an immutable, audited artifact.

The npm command performs a global installation and may execute package lifecycle scripts. The Go command downloads source from an external repository and compiles whichever release currently resolves as latest. If the package registry, upstream repository, maintainer account, or a future release is compromised, following these instructions could install and execute attacker-controlled code without any change to the reviewed Skill file.

This is a dependency supply-chain weakness. The audit did not establish that the current upstream package is malicious; exploitation depends on a compromised or maliciously changed dependency release.

Attack Path

1. An attacker compromises the npm package, upstream repository, maintainer credentials, or release process.
2. The attacker publishes a malicious version under the existing package identity.
3. A user follows the Skill's unpinned npm command or the Go command using @latest.
4. The package manager retrieves the attacker-controlled release.
5. Malicious npm lifecycle code may run during installation, or malicious functionality executes when mineru-open-api is subsequently invoked.
6. The payload operates with the privileges and accessible environment of the installing or invoking user.

Impact Assessment

Suc ...[truncated 520 chars]

Remediation

View remediation

Remediation Suggestions

• Pin both installation methods to specific, reviewed versions rather than relying on an implicit current npm release or Go's @latest.
• Prefer immutable release identifiers or reviewed commit hashes where supported.
• Publish and verify cryptographic checksums or signatures for the expected artifacts.
• Record the approved package version in the Skill metadata as well as in the installation examples so automated and manual installation paths remain consistent.
• Avoid global npm installation where practical. Use a project-local dependency, a lockfile, and a package-manager mode that enforces locked versions.
• Review npm lifecycle scripts before installation and disable them when they are unnecessary.
• Run the CLI with least privilege and provide only the files, token, and network access required for document extraction.
• Establish a controlled dependency-update process in which new releases are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to analyze local files and URLs through MinerU and requires an API token, but it does not clearly warn that document contents may be transmitted to an external third-party service. This creates a real risk of unintended disclosure of sensitive document data, especially because Word files commonly contain confidential business, legal, HR, or personal information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description includes generic trigger guidance such as 'analyze a Word document's content' and 'can my agent analyze a Word document', which are broad enough to overlap with ordinary user requests. It does not provide exclusion conditions or clear boundaries for when this skill should or should not activate, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.