ClawHub
Back to skill

Security audit

MinerU

Security checks for vulnerabilities and agentic risk

Overview

This MinerU connector is coherent overall, but its setup instructions ask users or agents to run unverified remote installer scripts directly in a shell.

Before installing, inspect the oo CLI installer or use a safer official package or pinned release if available. Do not let an agent run the remote installer automatically; approve installation explicitly and understand what local files, shell configuration, and account connections it changes.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Installation Scripts Are Executed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58–62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

The first-time setup instructions execute remotely retrieved installation scripts directly in Bash or PowerShell:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

Both installation methods pass a mutable network response directly to a command interpreter. The instructions do not pin a release version, validate a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded code before execution.

HTTPS provides transport protection but does not guarantee that the retrieved script is trustworthy if the hosting account, web server, DNS infrastructure, certificate issuance process, or software release pipeline is compromised. Because the effective payload remains under external control after this Skill has been reviewed, it can change without any corresponding modification to the audited project.

Installing a CLI is relevant to the declared MinerU connector functionality, but immediate execution of an unverified remote response exceeds the minimum privileges necessary. A verified package or pinned release artifact could provide the required functionality without granting mutable network content direct access to a local shell.

The documented connector commands also transmit JSON payloads, including document URLs, through OOMOL to MinerU. That data flow is disclosed and necessary for the declared extraction service. The audited content contains no evidence that raw credentials, private keys, environment variables, or unrelated local data are collected or transmitted.

Attack Path

  1. The oo command is unavailable and an agent or user follows the first-time setup instructions.
  2. An attacker compro ...[truncated 1149 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all direct pipe-to-shell and download-to-iex installation commands.
  2. Prefer an official operating-system package manager or a signed installer obtained from a pinned release.
  3. Pin the CLI to a specific version rather than retrieving a mutable installation script.
  4. Download the artifact to a local file without executing it automatically.
  5. Publish and verify a SHA-256 checksum and, preferably, a cryptographic signature whose verification key is distributed through an independent trusted channel.
  6. Display the source, version, destination, permissions, and expected installation changes before execution.
  7. Require explicit user approval before running any installer, and never install automatically merely because a connector command failed.
  8. Execute installation with ordinary user privileges unless a narrowly defined operation demonstrably requires elevation.
  9. Document how users can inspect the artifact and remove the installed CLI.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk: if the server, distribution path, or TLS trust chain is compromised, arbitrary code would execute immediately on the user's machine without inspection. In this skill context, the danger is increased because the installation step is presented as an operational fallback inside the workflow, making it more likely an agent or user will run it reflexively during error handling.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Static analysis

No suspicious patterns detected.