PDF to DOCX

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 0.4.0

Overview

This skill is a straightforward PDF-to-Word converter, but users should treat it as an external API workflow and be careful with sensitive documents.

Install only from the expected MinerU package sources, prefer a pinned version in an isolated environment, and avoid converting confidential PDFs unless you are comfortable with the MinerU API handling the document contents and token-protected requests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-21
Vulnerability Type: Unpinned executable dependency installation
Risk Level: Medium

Vulnerable Code

bash

npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

The installation instructions retrieve and execute mutable third-party dependencies without pinning an exact, reviewed version or immutable commit. The npm command implicitly installs the package version currently associated with the registry's default distribution tag, while the Go command explicitly requests @latest.

Consequently, the code installed by users can differ from the code reviewed when this skill was published. If the upstream package, maintainer account, package registry, repository, or release process is compromised, a malicious release could be distributed through these legitimate-looking commands. Installing the npm package globally also increases exposure by making the executable available throughout the user's environment.

This finding does not establish that the current mineru-open-api package is malicious. The risk arises from trusting mutable, remotely maintained executable dependencies without version and integrity controls.

Attack Path

1. An attacker compromises the upstream package, repository, maintainer credentials, or publishing workflow.
2. The attacker publishes a malicious version under the expected package identity or changes the release selected by latest.
3. A user follows the skill's documented installation command.
4. The package manager downloads and installs the attacker-controlled release.
5. Malicious code executes during package installation or when mineru-open-api is subsequently invoked.
6. The malicious process operates with the installing or invoking user's privileges and may access documents, environment variables, ...[truncated 675 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the npm dependency to an exact, reviewed version rather than relying on the registry's default tag:

  bash

  npm install -g mineru-open-api@<reviewed-exact-version>
  

• Replace the Go @latest reference with a fixed semantic version or reviewed commit:

  bash

  go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@<reviewed-version>
  

• Verify package provenance, publisher identity, release signatures, checksums, and registry integrity before installation.
• Document the expected package version and update it only after security review.
• Prefer an isolated, least-privilege environment instead of a global installation. Avoid installing or executing the converter as an administrator or root user.
• Restrict the converter's access to only the input and output directories required for the task.
• Avoid exposing unrelated credentials to the process, and provide MINERU_TOKEN only for the duration of the conversion.
• Where feasible, use dependency lockfiles, reproducible builds, artifact hashes, and automated supply-chain scanning.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description contains very broad trigger phrases such as generic requests to convert or edit PDFs in Word, which can cause over-invocation outside a tightly bounded context. In an agent setting, this increases the chance the skill is selected automatically for sensitive documents without an explicit user confirmation about sending content to an external conversion service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to convert local files and URLs using a token-authenticated MinerU API client but never discloses that document contents and referenced URLs may be transmitted to an external service. This creates a material data exposure risk, especially for legal, office, or other sensitive PDFs, because users and invoking agents may assume processing is local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The capability list states 'Language hint with --language (default: ch, use en for English)', which imposes a locale/language default in the natural-language documentation. This can conflict with language/locale policy when users are not offered an explicit choice before applying the default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.