Doc Parse

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:57 AM UTC
• Version: 0.4.0

Overview

This is a coherent Word-to-Markdown parsing skill, but users should review it because potentially sensitive documents may be processed through a third-party MinerU CLI/API without clear privacy disclosure.

Install only if you are comfortable using MinerU/OpenDataLab tooling for the documents you plan to parse. Avoid sensitive or regulated documents unless you have verified where content is processed and retained, pin the CLI to a reviewed version where possible, and run it with access only to the files and output directory needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party CLI Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-17
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

bash

npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

Both installation commands retrieve mutable third-party packages without selecting an immutable, previously audited release. The npm command omits a version entirely, causing the package manager to resolve the current default release. The Go command explicitly selects @latest.

The npm command also performs a global installation. If a resolved package contains malicious lifecycle scripts or executable content, that code could run during installation or when the installed CLI is invoked. The Go command downloads and compiles source selected from the upstream repository; malicious code introduced into the latest release would become part of the resulting executable.

This is a supply-chain weakness rather than evidence that the currently published dependency is malicious. The effective code installed by these instructions can change after the Skill itself has been reviewed.

Attack Path

1. An attacker compromises the upstream package registry account, source repository, release process, or maintainer credentials.
2. The attacker publishes a malicious release of mineru-open-api or modifies the revision resolved by @latest.
3. A user follows the installation instructions in SKILL.md.
4. The package manager resolves and downloads the attacker-controlled release because no audited version or immutable commit is specified.
5. Malicious npm installation hooks may execute during installation, or malicious functionality may execute when the installed CLI processes a document.
6. The payload operates with the permissions of the installing or invoking user.

Impact Assessment

Successful ...[truncated 615 chars]

Remediation

View remediation

Remediation Suggestions

• Pin both installation methods to an explicitly reviewed release rather than relying on the registry default or @latest.
• For npm, specify an exact version, such as npm install mineru-open-api@X.Y.Z, and prefer a project-local installation over a global installation where practical.
• For Go, replace @latest with a reviewed semantic version or immutable commit.
• Record and verify package integrity hashes, release signatures, and source provenance before installation.
• Use lockfiles or an internally controlled dependency mirror where the deployment model supports them.
• Review the pinned package for lifecycle scripts and transitive dependencies.
• Run the CLI with least privilege in an isolated environment or container, exposing only the documents and output directories required for the task.
• Establish a controlled update process in which new dependency releases are reviewed and tested before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports parsing local files and URLs via MinerU, an external service/API, but it does not warn users that document contents may be uploaded or transmitted off-host. This can lead to unintentional disclosure of sensitive document data, especially because Word files commonly contain confidential business, legal, or personal information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The line states that the language hint default is ch and users should use en for English, which sets a specific locale behavior by default. This is a natural-language locale policy concern because the skill does not present language selection as an explicit user choice or justify why Chinese is the default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.