Doc Extract

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:57 AM UTC
• Version: 0.4.0

Overview

This Word extraction skill appears legitimate, but it needs review because it may send documents or URLs to an external MinerU service without clearly explaining that privacy impact.

Install only if you are comfortable using MinerU/OpenDataLab tooling for the documents involved. Avoid confidential, regulated, credential-containing, or internal-only documents and URLs unless you have confirmed the tool's data handling and retention terms. Prefer a pinned, reviewed CLI version or an isolated install environment when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Global Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5,14-17
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw": {"emoji": "📄", "requires": {"bins": ["mineru-open-api"], "env": ["MINERU_TOKEN"]}, "primaryEnv": "MINERU_TOKEN", "install": [{"id": "npm", "kind": "node", "package": "mineru-open-api", "bins": ["mineru-open-api"], "label": "Install via npm"}, {"id": "go", "kind": "go", "package": "github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api", "bins": ["mineru-open-api"], "label": "Install via go install", "os": ["darwin", "linux"]}]}}

bash

npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

Both installation methods resolve mutable dependency versions. The npm command omits an explicit version and therefore installs the registry version associated with the current default distribution tag. The Go command explicitly uses @latest. The project provides no fixed version, immutable commit, checksum, signature-verification procedure, or vendored source with which users can reproduce and validate the dependency.

A compromised package-publishing account, upstream repository, release process, or registry could consequently replace the dependency after this Skill has been reviewed. npm packages can execute lifecycle scripts during global installation, while the Go source controls the resulting executable that users later invoke. Global npm installation also increases the affected local scope compared with an isolated, project-local installation.

This finding does not establish that the current upstream package is malicious. It identifies an exploitable supply-chain trust boundary created by installing mutable, unverified releases.

Attack Path

1. An attacker compromises the npm package, upstream reposito ...[truncated 1397 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm package to a specifically reviewed version instead of relying on the default distribution tag, using a form such as mineru-open-api@VERSION.
2. Replace the Go @latest reference with a fixed, reviewed release tag or immutable commit identifier.
3. Publish expected package checksums or signature-verification instructions and verify them before installation.
4. Prefer a project-local or otherwise isolated npm installation over a global installation where operationally possible.
5. Review the resolved package contents, npm lifecycle scripts, transitive dependencies, and Go module graph before approving a version.
6. Use automated dependency monitoring, but require security review before updating the pinned version.
7. Run the extraction tool with least privilege and provide only the files and environment variables required for the current operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises local file and URL support and instructs users to run a third-party CLI/API, but it does not clearly warn that document contents or referenced URLs may be transmitted to the external MinerU service. This can cause users to expose sensitive documents, credentials embedded in files, or internal-only URLs without informed consent, especially because the skill is framed as a simple local extraction tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.