Paper Parser

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 0.4.0

Overview

This skill is a straightforward guide for using MinerU to parse PDFs, with normal third-party install and token cautions but no hidden or destructive behavior found.

Install the MinerU CLI only from the expected publisher/source, avoid running installation with elevated privileges, prefer a pinned version if available, and expose MINERU_TOKEN only when needed. Be aware that PDFs or URLs submitted to the tool may be processed by MinerU's API service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependencies Installed from Mutable Upstream Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–16
Vulnerability Type: Unpinned and globally installed third-party dependencies
Risk Level: Medium

bash

npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

The documented installation procedures retrieve third-party software without pinning an audited version or verifying a checksum or cryptographic signature. The Go command explicitly uses the mutable @latest selector, while the npm command implicitly installs the package version currently associated with the registry's default distribution tag.

The npm package is also installed globally. A compromised package release could execute lifecycle scripts during installation and place attacker-controlled executables in a globally accessible binary directory. The installed command is subsequently expected to process potentially sensitive local documents and has access to the MINERU_TOKEN environment variable when invoked.

This finding does not establish that the current upstream package is malicious. The vulnerability is the unsafe dependency acquisition procedure, which allows the code installed by these instructions to change after the Skill has been reviewed.

Attack Path

1. An attacker compromises the npm publisher account, Go source repository, release process, or another relevant upstream distribution channel.
2. The attacker publishes a malicious release and makes it the version resolved by the npm default tag or Go's @latest selector.
3. A user follows the installation instructions in SKILL.md.
4. The package manager downloads the mutable, attacker-controlled version without integrity verification against a known-good artifact.
5. For npm, malicious lifecycle code may execute during installation. Alternatively, the installed CLI executes when the user later invokes `mineru- ...[truncated 920 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both installation methods to a specific, reviewed release rather than relying on the npm default tag or Go's @latest selector.
2. For npm, use an explicit version such as mineru-open-api@<reviewed-version> and prefer a project-local installation with a committed lockfile over a global installation.
3. For Go, use an explicit immutable version such as github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@vX.Y.Z.
4. Publish expected SHA-256 checksums or signature-verification instructions for approved release artifacts.
5. Document the verified package publisher, canonical repository, and expected package identity to reduce dependency-confusion and impersonation risks.
6. Review package lifecycle scripts and upstream release changes before updating the pinned version.
7. Run the parser as an unprivileged account, provide access only to required input and output paths, and expose MINERU_TOKEN only for the duration of the command.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown states --language defaults to ch and suggests using en for English, which imposes a specific locale behavior by default. This can violate language/locale policy expectations when users have not explicitly chosen a language.

Content

No source excerpt is available for this finding.