T09 · Insecure Skill Coding Practices
Error
- Location
scripts/doc-search/client.py:428- Finding
Local PDF Files Are Uploaded to a Public Staging Service by Default
- Content
View full analysis
- Remediation
View remediation
Security audit
MinerU Document Explorer
Security checks for vulnerabilities and agentic risk
Overview
This PDF skill is purpose-aligned, but its default setup can upload private PDFs to a public staging service despite claiming network features are opt-in.
Review the config before installing or using this skill. For private or regulated PDFs, change deployment_mode to local and clear server_url, avoid the public staging endpoint, do not run setup with elevated privileges, and expect local caches/logs to contain document-derived data unless manually cleared.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:43- Finding
Setup Installs Broad, Unpinned Dependencies into the System Python Environment
- Content
View full analysis
&1 | tail -5 ``` The package declarations use open-ended lower bounds and provide no hashes or lockfile: ```toml dependencies = [ "pyyaml>=6.0", "Pillow>=9.0", "pymupdf>=1.23", "requests>=2.28", ] [project.optional-dependencies] ocr = ["mineru-open-sdk>=0.1.0"] extraction = ["openai>=1.0", "httpx>=0.24", "mineru-open-sdk>=0.1.0"] embedding = ["faiss-cpu>=1.7", "numpy>=1.20"] pageindex = ["openai>=1.0", "tiktoken>=0.5"] server = ["fastapi>=0.104", "uvicorn>=0.24", "python-multipart>=0.0.6"] all = [ "mineru-open-sdk>=0.1.0", "openai>=1.0", "httpx>=0.24", "tiktoken>=0.5", "faiss-cpu>=1.7", "numpy>=1.20", "fastapi>=0.104", "uvicorn>=0.24", "python-multipart>=0.0.6", ] ``` ### Technical Analysis The installer invokes pip against the selected system Python interpreter with the `all` extra. This installs OCR, LLM, embedding, and server dependencies even when the user only needs basic local PDF access. Every dependency is specified using a lower bound without an upper bound or exact version. Therefore, the effective software installed during setup can change after the Skill has been reviewed. No lockfile or cryptographic hash verification constrains downloaded artifacts. The `--break-system-packages` ...[truncated 2413 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (125)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented setup flow includes installing dependencies, modifying configuration, and writing local state, which goes beyond what a user may expect from a PDF-reading skill. Combining setup automation with broad activation increases the risk of unintended system modification or configuration drift.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code transmits processed image regions to a cloud OCR SDK with no explicit user-facing notice that document contents are leaving the local environment. In a document-reading skill, this is especially dangerous because users may submit sensitive PDFs containing personal, financial, legal, or proprietary data under the assumption of local-only analysis.
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The logger is explicitly designed to store all messages in memory and write them to disk, and because this module processes PDF text and LLM prompts/responses, those messages can contain sensitive document contents or derived summaries. In a document-exploration skill, such persistent logging materially increases context leakage risk by broadening access beyond the active processing path and creating durable artifacts that may be read later by other users, tools, or processes.
- Content
python current_time = datetime.now().strftime("%Y%m%d_%H%M%S") self.filename = f"{pdf_name}_{current_time}.json" os.makedirs("./logs", exist_ok=True) # Initialize empty list to store all messages self.log_data = [] def log(self, level, message, **kwargs):
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares network, file read/write, and environment-dependent behavior but does not define a restrictive tool scope such as allowed-tools or permissions. That creates an unnecessarily large operational surface for a skill that is advertised as a PDF-reading helper, making misuse, overreach, or accidental invocation of sensitive capabilities more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Marking the skill as REQUIRED for essentially any PDF reading or understanding task is overly broad and increases the blast radius of all risky behaviors in the skill, including network use, file writes, setup actions, and caching. Over-broad activation makes accidental invocation on sensitive PDFs more likely.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The setup workflow instructs the agent to modify local configuration files for optional external services as part of a generally triggered PDF-reading skill. This is dangerous because it mixes content-processing with persistent system changes, increasing the chance of unauthorized or unexpected local modifications.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The mandatory instruction to append lessons learned to references/tips.md causes every PDF task to perform a file write unrelated to the user's request. This creates an unnecessary persistence channel that can leak document-derived information, accumulate prompt-influenced content, and enable cross-task contamination of future runs.
- Content
Static analysis
No suspicious patterns detected.