HTML Extract

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 2:09 AM UTC
• Version: 0.4.0

Overview

This skill is a straightforward HTML-to-Markdown helper using MinerU, but users should treat it as an external API workflow and avoid sending sensitive pages or files unintentionally.

Install only from sources you trust, prefer pinned or isolated installs when possible, and do not process private, proprietary, credential-bearing, or internal HTML files or URLs unless you intentionally want MinerU's external service involved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Global Installation of Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-18
Vulnerability Type: Supply-chain risk from mutable, globally installed dependencies
Risk Level: Medium

Vulnerable Code

bash

## Install

```bash
npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

text

### Technical Analysis

The installation instructions retrieve mutable third-party dependency versions without pinning them to a reviewed release or immutable commit. The Go command explicitly requests `@latest`, while the npm command omits a version and therefore installs the package version currently associated with the registry's latest distribution tag.

The npm command also performs a global installation. Depending on the host configuration, this may install executables into system-wide locations or prompt the user to run the command with elevated privileges. Neither installation path includes checksum, signature, provenance, or integrity-verification instructions.

If the upstream repository, npm package, maintainer account, release pipeline, or package distribution channel is compromised, a malicious release could be delivered after this Skill has already been reviewed. Package installation hooks or the resulting CLI executable could then run attacker-controlled code with the permissions of the user performing installation or invoking the tool.

### Attack Path

1. An attacker compromises the upstream package, repository, maintainer credentials, release pipeline, or distribution account.
2. The attacker publishes a malicious version and makes it the version selected by the npm latest tag or Go's `@latest` resolution.
3. A user follows the instructions in `SKILL.md`.
4. The package manager downloads the mutable malicious release without verification against a reviewed version or integrity value.
5. Malicious installation hooks or executable code run with the invoking user's permissions.
6
...[truncated 800 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm dependency to a specific reviewed version rather than relying on the latest distribution tag:

   bash

   npm install mineru-open-api@<reviewed-version>
   

2. Pin the Go dependency to a specific reviewed semantic version or immutable commit instead of @latest:

   bash

   go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@<reviewed-version-or-commit>
   

3. Publish expected checksums, signatures, or verifiable provenance for approved releases and instruct users to validate them before execution.
4. Prefer a project-local installation, isolated environment, or container over a global npm installation.
5. Explicitly advise users not to install the package with root or administrator privileges.
6. Periodically review pinned releases and update them through a controlled security review process.
7. Where supported, use package-manager lockfiles and dependency-integrity metadata to make dependency resolution reproducible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description lists activation examples such as 'get text from a web page', 'parse this web page', and 'I want to read this HTML file' without narrowing context or providing exclusion conditions. These phrases are broad enough to match everyday user requests, which could cause unintended skill invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to send local HTML files or remote URLs to a token-authenticated external service without clearly warning that page content, URLs, and possibly sensitive local file contents may be transmitted off-host. In agentic workflows, this can cause unintended exfiltration of proprietary, internal, or personal data when a user merely asks to 'read' or 'extract' an HTML resource.

Content

No source excerpt is available for this finding.