Doc To Markdown

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:52 AM UTC
• Version: 0.4.0

Overview

The skill appears purpose-aligned for Word-to-Markdown conversion, but it needs review because it installs a mutable third-party CLI and does not clearly warn that document contents may be processed by an external MinerU service.

Install only if you are comfortable using MinerU/OpenDataLab tooling for the documents you convert. Treat documents as potentially sent to an external service unless you independently verify a local-only mode, avoid confidential files without approval, use a pinned and reviewed CLI version when possible, and provide MINERU_TOKEN only to the specific command that needs it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12 and 21-23
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw": {"emoji": "📄", "requires": {"bins": ["mineru-open-api"], "env": ["MINERU_TOKEN"]}, "primaryEnv": "MINERU_TOKEN", "install": [{"id": "npm", "kind": "node", "package": "mineru-open-api", "bins": ["mineru-open-api"], "label": "Install via npm"}, {"id": "go", "kind": "go", "package": "github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api", "bins": ["mineru-open-api"], "label": "Install via go install", "os": ["darwin", "linux"]}]}}

bash

npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

Both documented installation methods resolve a mutable version of an external executable. The npm command provides no exact package version and installs the package globally. The Go command explicitly selects @latest. No lockfile, immutable commit, checksum, signature-verification procedure, or reviewed version is specified.

Consequently, the code installed by users can change after this Skill has been reviewed without requiring any modification to SKILL.md. If the upstream repository, package-registry account, release pipeline, maintainer account, or package distribution channel is compromised, a malicious release could be delivered through these instructions.

npm packages can execute lifecycle scripts during installation unless scripts are disabled. The resulting CLI also executes with the invoking user's privileges when used. The Skill additionally expects the CLI to process potentially sensitive documents and, for some operations, have access to MINERU_TOKEN. There is no evidence in the audited file that the current package is malicious; the confirmed issue is the absence of immutable dependency pinn ...[truncated 1576 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm package to an exact, reviewed version rather than relying on the registry default:

   bash

   npm install --global --ignore-scripts mineru-open-api@REVIEWED_EXACT_VERSION
   

   Confirm compatibility before disabling lifecycle scripts, and do not use --ignore-scripts if the reviewed package legitimately requires them without first assessing the resulting risk.

2. Pin the Go installation to a reviewed semantic version or, preferably, an immutable commit instead of @latest:

   bash

   go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@REVIEWED_VERSION_OR_COMMIT
   

3. Record expected artifact checksums or signature-verification instructions and verify downloaded releases before execution.

4. Update the Skill metadata so automated installation uses the same immutable versions as the documented commands.

5. Prefer a project-local or isolated installation over a global npm installation. Run the CLI in a restricted container or sandbox with access only to the input and output paths required for conversion.

6. Provide MINERU_TOKEN only to commands that require authenticated extraction. Use a narrowly scoped, revocable token and avoid exposing unrelated secrets to the CLI process.

7. Establish a controlled dependency-update process in which new versions are reviewed, tested, and explicitly pinned before being recommended.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly supports local files and URLs and is built around the mineru-open-api CLI, which sends document content to an external MinerU service for processing, yet the description does not clearly disclose this data flow. Users may provide sensitive Word documents assuming local conversion, causing unintended exfiltration of confidential content to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The notes say the default language is ch and users should use en for English, which establishes a locale default in natural language. Because the skill does not explicitly offer a neutral choice or justify the default as region-specific, this is a language/locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.