PDF to LaTeX

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:52 AM UTC
• Version: 0.4.0

Overview

This skill is a straightforward PDF-to-LaTeX helper, but users should understand it relies on a third-party MinerU CLI/API and should avoid sensitive documents unless they accept that service's handling terms.

Before installing, verify that mineru-open-api is the intended package or Go module, consider pinning a known version, and do not process confidential PDFs unless you have reviewed MinerU/OpenDataLab privacy, retention, and security terms.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Global npm Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, line 15 **Vulnerability Type**: Supply-chain exposure through an unpinned third-party package **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g mineru-open-api ``` ### Technical Analysis The installation command retrieves the currently resolved version of `mineru-open-api` from the npm registry and installs it globally. No exact version, lockfile, integrity hash, or provenance verification is provided. Consequently, the code installed by users can differ from the version that was available when the skill was audited. npm packages can define lifecycle scripts that run during installation. If the package publisher, npm account, or package distribution channel is compromised, a malicious release could execute code during installation with the permissions of the invoking user. A globally installed package can also replace the corresponding command available in the user's executable search path. ### Attack Path 1. An attacker compromises the npm package publisher, publication credentials, or distribution process. 2. The attacker publishes a malicious release under the legitimate `mineru-open-api` package name. 3. A user follows the documented unpinned installation command. 4. npm resolves the package to the compromised release. 5. Malicious lifecycle code may run during installation, or malicious behavior may execute when the installed CLI is invoked. ### Impact Assessment Successful exploitation could execute arbitrary code with the permissions of the user running npm. This may permit access to files, environment variables, credentials available to that user, and documents subsequently supplied to the CLI. The global installation also makes the compromised executable available to later shell sessions. No evidence indicates that the reviewed skill itself contains such a payload; the risk arises from mutable upstream dependency resolution.
• Remediation: ## Remediation Suggestions - Pin `mineru-open-api` to a reviewed exact version rather than allowing npm to select the current release. - Publish and verify the expected package integrity digest and package provenance. - Use a project-local installation with a committed lockfile instead of a global installation where practical. - Document the canonical npm package owner and registry source to reduce dependency-confusion and impersonation risks. - Review lifecycle scripts and package contents before recommending an updated version. - Run the conversion tool with least privilege and avoid exposing unrelated credentials or sensitive directories to it.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Go CLI Installation from a Mutable Latest Revision## Vulnerability Details **File Location**: `SKILL.md`, line 17 **Vulnerability Type**: Supply-chain exposure through mutable dependency resolution **Risk Level**: Medium ### Vulnerable Code ```bash go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest ``` ### Technical Analysis The `@latest` selector causes Go to resolve and build whichever upstream version is considered current at installation time. The skill does not pin a reviewed semantic version or commit hash and does not provide an expected checksum or other independent provenance check. Therefore, the effective executable can change after the skill has been reviewed. If the upstream repository, maintainer credentials, release process, or referenced module is compromised, users may build and install an attacker-controlled CLI. The malicious behavior would execute when the resulting `mineru-open-api` binary is invoked to process a document. ### Attack Path 1. An attacker gains control of the upstream repository, maintainer credentials, or release process. 2. The attacker publishes a compromised revision that resolves through `@latest`. 3. A user runs the documented `go install` command. 4. Go downloads and builds the compromised source into the user's Go binary directory. 5. The malicious payload executes when the user invokes `mineru-open-api`, potentially while the tool has access to a MinerU token and input documents. ### Impact Assessment Successful exploitation could run arbitrary code with the permissions of the user invoking the installed CLI. It could access files and environment variables available to that process, including `MINERU_TOKEN`, and could read or alter documents provided for conversion. The installed binary remains available for subsequent use until removed or replaced. The audited project contains no evidence that the current upstream tool is malicious; the finding concerns the inability to guarantee a stable, revie ...[truncated 24 chars]
• Remediation: ## Remediation Suggestions - Replace `@latest` with a reviewed, immutable semantic version or commit identifier. - Publish the expected module version, source commit, and executable or source checksum. - Verify the upstream repository and release provenance before updating the pinned revision. - Establish a controlled dependency-update process that includes source review and security testing. - Execute the installed CLI with least privilege and provide only the files and environment variables required for conversion.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to submit local PDFs or remote URLs to the MinerU service and requires an API token, which strongly implies document contents may leave the local environment. Because the skill does not clearly disclose this external transmission, users may unknowingly send sensitive papers, unpublished manuscripts, or proprietary documents to a third-party service.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The natural-language note states that the default language hint is `ch` and suggests using `en` for English, which imposes a locale default rather than offering a neutral or user-chosen setting. This can conflict with language/locale policy expectations when no explicit opt-in or region-specific justification is provided.

Static analysis

No suspicious patterns detected.