ClawHub
Back to skill

Security audit

Table Ocr

Security checks across malware telemetry and agentic risk

Overview

This is a MinerU table-OCR helper with disclosed external CLI and token use, but users should treat processed files or URLs as potentially sent to MinerU.

Install only if you trust MinerU and the mineru-open-api package. Treat MINERU_TOKEN like an API key, avoid processing confidential PDFs/images or internal URLs unless MinerU is approved for that data, and review where the CLI stores authentication before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is presented as a local table-OCR tool for scanned PDFs and images, but the documentation also states it supports URLs, which broadens the trust boundary from user-supplied local files to arbitrary remote content. That creates an unexpected network-fetch capability and can lead to data exfiltration, SSRF-like misuse, or processing of untrusted remote documents without clear user awareness.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The authentication section states that both `extract` and `crawl` require a token, even though the skill is scoped to table OCR from scanned PDFs and images. Exposing a crawl operation expands capability beyond the declared purpose and may enable broad remote content collection or website retrieval behavior not expected by users invoking a document OCR skill.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Supporting remote URL processing is a meaningful expansion from 'OCR scanned files' to 'fetch and process network resources.' In an agent context, this can be abused to access attacker-controlled content, trigger requests to unintended destinations, or send sensitive document-processing tasks to external infrastructure without a purpose-justified reason.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill advertises URL inputs and relies on a tokenized external MinerU service, but it does not warn users that submitted documents or fetched remote content may leave the local environment. This omission undermines informed consent and can result in accidental disclosure of sensitive PDFs, images, or URLs to a third-party service.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.