Extract Tables From Pdf

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:04 AM UTC
• Version: 0.4.0

Overview

The skill is generally about PDF table extraction, but it needs Review because it can process local documents through a third-party tokenized CLI without clear privacy disclosure and recommends unpinned global installation.

Install only if you are comfortable using MinerU's third-party CLI and token for the PDFs or URLs you provide. Avoid confidential, regulated, or customer documents unless you have approval for external processing, prefer a pinned/local install over global latest-version commands, and keep use limited to table extraction rather than general PDF or crawl workflows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party CLI Installation Enables Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–17
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable code snippet:

bash

npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

The installation instructions retrieve executable code without pinning an immutable, reviewed version. The npm command omits a package version and installs the package globally, while the Go command explicitly requests the mutable @latest release.

Consequently, the code installed by these commands can differ from the code originally reviewed. If the upstream package, repository, maintainer account, or publishing workflow is compromised, users following the documented instructions could install attacker-controlled executable code. No integrity hash, commit identifier, lockfile, signature-verification procedure, or other mechanism is provided to ensure that the retrieved artifact is a known-good release.

Attack Path

1. An attacker compromises the upstream npm package, Go repository, maintainer credentials, or release pipeline.
2. The attacker publishes a malicious package version or changes the release resolved by @latest.
3. A user follows the Skill's installation instructions.
4. The package manager downloads and installs the mutable attacker-controlled release.
5. The malicious code executes with the invoking user's privileges when installation hooks run, if present, or when mineru-open-api is invoked.
6. The malicious executable can access resources available to that user, including submitted PDF documents, the MINERU_TOKEN environment variable, and writable local files.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user performing the installation or running the CLI. The affected sc ...[truncated 563 chars]

Remediation

View remediation

Remediation Suggestions

• Pin npm installation to a specifically reviewed version, for example mineru-open-api@X.Y.Z.
• Pin the Go installation to a reviewed semantic version or immutable commit rather than @latest.
• Publish expected checksums or signatures and require users to verify downloaded artifacts before execution.
• Prefer a project-local npm installation with a lockfile instead of a global installation.
• Avoid running package installation commands with administrative privileges.
• Use dependency monitoring and periodically review pinned releases for known vulnerabilities.
• Document the package's publisher, trusted source, expected artifact identity, and verification process.
• Clearly document whether local PDFs are uploaded to a remote service and how credentials and submitted documents are handled.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad enough to match common PDF-related requests, including generic parsing and conversion asks, without clearly constraining use to table extraction. In an agent setting, overbroad routing language can cause the skill to be selected for tasks involving sensitive PDFs even when table extraction was not specifically requested.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill handles local files and URLs and requires a service token, but it does not clearly warn that document contents or fetched URL data may be transmitted to an external MinerU-backed service. This is a significant privacy and compliance risk because users may provide confidential PDFs without informed consent about third-party processing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is named and described as table extraction, but the body says 'Convert and extract content from .pdf', expanding the implied capability to general PDF extraction. That mismatch can cause an agent to invoke the skill for broader document processing than the user intended, increasing risk of unnecessary data disclosure to the external MinerU service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The authentication section states the token is required for 'extract' and 'crawl', even though 'crawl' is outside the skill's stated purpose. Mentioning an unrelated capability can prime an agent or user to treat the skill as authorized for broader remote-content retrieval, which expands scope and may lead to unintended external requests or data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The line states a default language hint of ch and only mentions using en for English, which imposes a locale default rather than presenting language selection neutrally. For natural-language policy review, this can be a locale-choice issue when users are not explicitly offered opt-in or automatic detection as the preferred behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.