ClawHub
Back to skill

Security audit

Doc Analysis

Security checks for vulnerabilities and agentic risk

Overview

This looks like a document-extraction helper, but users should assume files or URLs they process may be sent to MinerU for extraction.

Install only if you are comfortable using MinerU or the configured extraction backend for the documents you provide. Avoid sending confidential, regulated, or private files until you have reviewed the service's data-handling terms and confirmed whether local-only processing is available.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises support for local files and URLs and requires a token for full extraction, but it does not clearly disclose that document contents may be sent to an external MinerU service. Users may unknowingly upload sensitive document contents or remote URLs containing private data to a third party, creating confidentiality and compliance risks.

Static analysis

No suspicious patterns detected.