Security audit

PDF Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward PDF-analysis helper, but users should treat analyzed PDFs as potentially shared with the MinerU service and install the CLI carefully.

Install only if you are comfortable using MinerU's CLI and service for the PDFs you choose to analyze. Prefer a pinned CLI version, avoid running global installs with elevated privileges, and do not process confidential, regulated, or internal documents unless external API processing is allowed by your policy.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
``` 2. Replace the Go `@latest` reference with an exact reviewed semantic version or immutable commit: ```bash go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@ ``` 3. Apply the same version pinning to the package declaration in the Skill metadata. 4. Publish expected checksums or signature-verification instructions for approved release artifacts. 5. Prefer a project-local npm installation with a lockfile over a global installation where practical. 6. Review dependency ownership, release provenance, transitive dependencies, and npm lifecycle scripts before approving a version. 7. Run the CLI under a least-privileged account and provide it only the documents and environment variables required for the task. 8. Upgrade versions through an explicit review process rather than automatically tracking the latest release. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill encourages analysis of local PDFs and PDF URLs through mineru-open-api but does not clearly disclose that document contents may be transmitted to an external MinerU service. This can cause users to send sensitive internal, personal, or regulated documents off-system without informed consent, especially because the examples make remote processing appear routine.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This line states a default language hint of ch and tells users to switch to en for English, which embeds a locale preference in the skill documentation. Under the policy, language constraints should either be user-selectable or clearly justified; here the documentation does not frame the choice as an opt-in or explain why that default is required.
Content: No source excerpt is available for this finding.