PPTX Analysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:35 AM UTC
• Version: 0.4.0

Overview

This skill has a coherent PowerPoint-analysis purpose, but users should review its third-party service/data-handling and unpinned CLI installation risks before installing.

Install only if you are comfortable using MinerU/OpenDataLab tooling on the presentations you provide. Do not process confidential slide decks or private URLs unless you have confirmed the service's data-handling terms. Prefer a pinned, reviewed CLI version in an isolated environment, and expose only the MINERU_TOKEN needed for this tool.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-18
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

The skill instructs users to install mineru-open-api from mutable upstream sources without specifying a reviewed version, checksum, lockfile, or signature.

yaml

metadata: {"openclaw": {"emoji": "📄", "requires": {"bins": ["mineru-open-api"], "env": ["MINERU_TOKEN"]}, "primaryEnv": "MINERU_TOKEN", "install": [{"id": "npm", "kind": "node", "package": "mineru-open-api", "bins": ["mineru-open-api"], "label": "Install via npm"}, {"id": "go", "kind": "go", "package": "github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api", "bins": ["mineru-open-api"], "label": "Install via go install", "os": ["darwin", "linux"]}]}}

bash

npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

The npm installation command resolves to the registry's current package version, while the Go command explicitly resolves the mutable @latest version. Consequently, the code installed by following these instructions can change after this skill has been reviewed.

The project does not provide an exact dependency version, cryptographic checksum, signed-release verification procedure, lockfile, or vendored source. The npm command also installs the package globally, exposing its executable system-wide and potentially executing package lifecycle scripts during installation. The Go command retrieves and compiles upstream source whose content depends on the version selected as latest.

This does not prove that the current upstream package is malicious. It creates a supply-chain exposure in which compromise of the package registry, upstream repository, maintainer account, or a future release could cause users to install attacker-controlled code.

Attack Path

1. An attacker compromises the upstream package, its re ...[truncated 1623 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both installation methods to exact, reviewed versions rather than relying on the current registry release or @latest:

   bash

   npm install -g mineru-open-api@<reviewed-version>
   go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@v<reviewed-version>
   

2. Publish expected cryptographic checksums or require verification of signed upstream releases before installation.
3. Record the reviewed package version and source commit in the skill metadata.
4. Add an npm lockfile or equivalent reproducible dependency manifest where the deployment model permits it.
5. Prefer a local, isolated installation over a global npm installation, and execute the CLI in a sandbox or container with access limited to the required presentation and output directory.
6. Do not expose unrelated secrets to the CLI process. Supply MINERU_TOKEN only when full extraction requires it and use a narrowly scoped, revocable token.
7. Review package lifecycle scripts and transitive dependencies before approving a new version.
8. Establish an update process that performs source review, integrity verification, and security testing before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to analyze local files or URLs with a third-party CLI/service but does not clearly warn that presentation contents may be transmitted to an external MinerU service. This can cause unintentional disclosure of sensitive slide content, internal documents, or confidential URLs because users may reasonably assume a local file analysis stays local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This line specifies a default language hint of ch and tells users to switch to en for English, which imposes a locale default in the skill documentation without offering neutral language choice or documenting why that default is required. That can violate language/locale policy expectations when a skill is intended for general use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.