Doc To Text

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:04 AM UTC
• Version: 0.4.0

Overview

This skill has a coherent Word-to-text purpose, but users should review it because it relies on an unpinned global third-party CLI and does not clearly explain whether local documents may be sent to MinerU/OpenDataLab services.

Before installing, treat this as a third-party document-processing integration. Avoid sensitive legal, financial, personal, or confidential Word files unless you have confirmed where processing happens and are comfortable with MinerU/OpenDataLab handling the content. Prefer pinning an audited CLI version, using an isolated environment, and limiting the token and filesystem access exposed to the tool.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–15
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Complete Code Snippet

bash

## Install

```bash
npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

The installation instructions retrieve third-party software without specifying an audited, immutable version, commit, checksum, or cryptographic signature. The Go command explicitly uses the mutable @latest reference, while the npm command resolves the registry's current package version and installs it globally.

Consequently, the code executed by users can change after this Skill has been reviewed. A malicious or compromised release, registry account, upstream repository, or transitive dependency could introduce arbitrary installation-time or runtime behavior. The project contains only SKILL.md; it does not include the CLI implementation or a lockfile that would permit review of the effective dependency code.

The global npm installation also increases exposure by making the executable broadly available in the user's environment. Depending on package behavior and local npm configuration, lifecycle scripts may execute during installation.

Attack Path

1. An attacker compromises the mineru-open-api package, its publisher account, upstream repository, release process, or a relevant dependency.
2. The attacker publishes a malicious version or modifies the version resolved through @latest.
3. A user or agent follows the documented installation command.
4. The package manager downloads the mutable, attacker-controlled release.
5. Malicious installation hooks or CLI runtime code execute with the permissions of the installing user.
6. The compromised CLI can access files supplied for document extraction, process environment data such as MINERU_TOKEN, and any other resources avai ...[truncated 787 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm package to a specifically audited version rather than resolving the current registry release:

   bash

   npm install -g mineru-open-api@<audited-version>
   

2. Pin the Go installation to an audited semantic version or immutable commit instead of @latest:

   bash

   go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@<audited-version-or-commit>
   

3. Publish expected package checksums or signature-verification instructions and require verification before installation.
4. Record the reviewed package version and provenance in SKILL.md.
5. Prefer a project-local or isolated installation over a global installation to reduce environmental exposure.
6. Audit the pinned CLI release, its installation hooks, and its transitive dependencies.
7. Run document processing with least privilege in a sandbox or container, exposing only the required input and output paths.
8. Provide MINERU_TOKEN only when required, avoid unnecessarily inherited environment variables, and document whether files or extracted content are transmitted to external services.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises support for local files and URLs via MinerU but does not disclose that document contents may be transmitted to an external service for processing. This can cause unintended exfiltration of sensitive document data, especially when users assume a local conversion workflow for internal, legal, financial, or personal files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This line states a default language hint of ch and only optionally mentions en for English. That imposes a locale/language default in the skill instructions without offering an explicit user choice or documenting why that default is required for this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.