HTML Parse

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 2:11 AM UTC
• Version: 0.4.0

Overview

This skill is a straightforward MinerU HTML-to-Markdown helper, with normal external-service and install risks users should understand before use.

Install the CLI from a trusted source, prefer a pinned or reviewed version when possible, and do not parse confidential local HTML, authenticated pages, intranet URLs, or regulated data unless you are comfortable sending that content through MinerU. Set MINERU_TOKEN only where this tool needs it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-16
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash

npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

The installation instructions retrieve and install externally maintained executable code without pinning it to an audited version, commit, checksum, or cryptographic signature. The Go command explicitly uses the mutable @latest reference, while the npm command omits a version and therefore resolves the package version from the registry at installation time.

The npm command also performs a global installation. Depending on the npm configuration, installation may execute package lifecycle scripts and place executable files in globally accessible package locations. The reviewed project does not contain a lockfile, integrity hash, signature-verification procedure, or vendored copy that would bind installation to the dependency version assessed during this audit.

This finding concerns the unsafe dependency acquisition instructions. The available artifact does not establish that the upstream package is currently malicious.

Attack Path

1. An attacker compromises the upstream npm package, Go repository, release process, registry account, or another dependency in the external package's supply chain.
2. The attacker publishes a malicious version that becomes the version selected by the unversioned npm command or the Go @latest reference.
3. A user follows the documented installation instructions.
4. The package manager retrieves the attacker-controlled release, which was not part of this audited artifact.
5. Malicious installation hooks or installed executable code run with the permissions of the user performing the installation.
6. Subsequent invocations of mineru-open-api can execute the substituted payload w ...[truncated 711 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the npm package to an exact, reviewed version rather than relying on registry resolution, for example mineru-open-api@X.Y.Z.
• Pin the Go installation to a reviewed semantic version or immutable commit instead of @latest.
• Publish expected checksums or signature-verification instructions and require users to validate downloaded artifacts before execution.
• Document the exact dependency versions that were security-reviewed and establish a controlled process for upgrading them.
• Prefer a project-local or isolated installation over a global npm installation where operationally possible.
• Disable npm lifecycle scripts during installation when they are not required, and verify functionality before recommending that control.
• Review the selected upstream release and its transitive dependencies, provenance, maintainer controls, and release-signing practices.
• Run the CLI with least privilege and avoid installing or invoking it as an administrator or root user.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly encourages parsing remote URLs and crawling live web pages via a third-party service, but it does not clearly warn that the target URL and retrieved content will be transmitted off-host to MinerU and may expose sensitive internal or private data. In an agent context, this can lead to unintended data disclosure, especially if users provide intranet URLs, authenticated pages, or confidential local-to-remote targets without understanding the network boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states a default language of ch and only mentions en as an alternative, which imposes a locale choice without explicit user selection. This can violate language/locale policy expectations unless the user is given a clear opt-in choice or the regional default is justified.

Content

No source excerpt is available for this finding.