ClawHub
Back to skill

Security audit

HTML OCR

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward HTML OCR helper, with a disclosed MinerU token and CLI dependency, but users should pin or isolate the third-party CLI install.

Install the MinerU CLI only from the official package or repository, preferably pinned to a reviewed version and in an isolated environment. Treat `MINERU_TOKEN` as a credential, and do not process confidential HTML documents unless you are comfortable with MinerU API handling the content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party CLI Installed Globally

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: Unpinned third-party dependency and mutable supply-chain source
Risk Level: Medium

The skill directs users to install a third-party executable globally without pinning it to a reviewed version or immutable commit.

bash
npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

Both commands retrieve executable code from mutable external package sources. The npm command omits a version and therefore resolves the package version through the registry at installation time. The Go command explicitly uses @latest. Consequently, the installed code can differ from the code that existed when this skill was reviewed.

The npm package is installed globally, increasing its availability and exposure on the user's system. Neither installation path provides checksum validation, signature verification, an immutable commit reference, or another mechanism for ensuring that the retrieved artifact is the reviewed release.

This creates a supply-chain risk if the package registry, upstream repository, maintainer account, publication process, or a future release is compromised. The repository under audit does not itself contain a malicious payload, and no current upstream compromise was established; the vulnerability is the unsafe dependency acquisition practice.

Attack Path

  1. An attacker compromises the upstream package, repository, maintainer account, or release process.
  2. The attacker publishes a malicious version under the expected package identity or causes the mutable latest reference to resolve to attacker-controlled code.
  3. A user follows the installation instructions in SKILL.md.
  4. The package manager downloads and installs the malicious executable without verifying an audited version or immutable artifact.
  5. Install ...[truncated 1127 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the npm dependency to a specific reviewed version, for example:
    bash
    npm install -g mineru-open-api@<reviewed-version>
  2. Replace the Go @latest reference with a specific reviewed semantic version or immutable commit:
    bash
    go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@<reviewed-version-or-commit>
  3. Publish expected artifact checksums or require cryptographic signature/provenance verification before installation.
  4. Prefer a project-local or isolated installation over a global installation, such as a locked project dependency, container, or restricted execution environment.
  5. Maintain a lockfile or equivalent dependency manifest where supported and review dependency changes before updating pinned versions.
  6. Document the trusted package publisher and canonical repository so users can detect similarly named or spoofed packages.
  7. Run the OCR client with least privilege and expose only the files and environment variables required for the operation. Avoid processing sensitive documents until the dependency's remote data-handling behavior has been independently verified.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.