ClawHub
Back to skill

Security audit

Table Ocr

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward MinerU table-OCR helper, with normal third-party CLI and API-token trust considerations.

Install only if you trust MinerU/OpenDataLab and are comfortable sending the documents you process to that service. Prefer a pinned reviewed CLI version where possible, avoid running install commands with elevated privileges, and keep the MinerU token scoped and protected.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Global Installation of Executable Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-17
Vulnerability Type: Unpinned executable dependency installation
Risk Level: Medium

Vulnerable Code

bash
npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Technical Analysis

The installation instructions retrieve executable dependencies without pinning them to reviewed, immutable versions. The npm command omits a version entirely, causing the package manager to resolve the current registry version. The Go command explicitly selects the mutable @latest version.

Both commands install a CLI executable from an external dependency source. The npm installation is global, increasing the dependency's accessibility within the user's environment. No checksum, signature, commit hash, or other integrity-verification mechanism is documented. Consequently, the code installed by these commands can change after the skill itself has been audited.

This creates a supply-chain risk if the package registry account, upstream repository, release process, or package ownership is compromised. The audit found no evidence that the currently referenced project is malicious; the vulnerability is the unsafe, mutable installation method.

Attack Path

  1. An attacker compromises the npm package, upstream Go repository, maintainer credentials, or associated release process.
  2. The attacker publishes a malicious version that becomes the default npm release or the revision resolved by @latest.
  3. A user follows the installation instructions in SKILL.md.
  4. The package manager downloads and installs the altered executable without validating it against a version and integrity value reviewed by the skill author.
  5. Malicious code may execute during an npm installation lifecycle script or when the installed mineru-open-api command is invoked.
  6. The payload operates with ...[truncated 765 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin both installation methods to specific versions that have been reviewed:
    bash
    npm install -g mineru-open-api@<reviewed-version>
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@<reviewed-version-or-commit>
  2. Prefer immutable Go commit hashes or signed release tags rather than @latest.
  3. Publish expected package checksums or signatures and instruct users to verify downloaded artifacts before execution.
  4. Avoid global npm installation where practical. Use a project-local dependency with a lockfile and invoke it through the package manager.
  5. Disable unnecessary npm lifecycle scripts during installation when compatible with the package, or review all lifecycle scripts before permitting execution.
  6. Document a tested version-upgrade process that includes source review, provenance verification, and integrity-value updates.
  7. Advise users not to run installation commands with administrative privileges unless demonstrably necessary.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

Line L46 states that the --language default is ch, which imposes a specific locale behavior by default. The file does not present this as a user choice or clearly justify the locale default as a region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.