Doc Analysis

Analyze the structure, layout, and content of Word documents (.doc, .docx) using MinerU. Returns structured Markdown with headings, paragraphs, tables, and l...

Security Scan

The skill is internally consistent: it calls a named MinerU CLI, requires a MinerU token, and its install/auth instructions align with its stated purpose of analyzing Word documents.

Purpose & Capability

Name/description (Word document analysis) match the declared binary (mineru-open-api) and the single required env var (MINERU_TOKEN). Requiring a MinerU CLI and token is expected for a hosted/open-source document analysis service.

Instruction Scope

Runtime instructions stick to running the mineru-open-api CLI on local files or URLs and handling stdout/stderr. One minor inconsistency: SKILL.md notes a 'flash-extract' mode that requires no token while metadata marks MINERU_TOKEN as required; this is likely an over-assertion in metadata rather than malicious scope creep.

Install Mechanism

Installers are standard: npm package and a Go 'go install' from a GitHub repo. No download-from-untrusted-URL or archive extraction steps are present. These are moderate-risk (npm/GitHub) but appropriate for a CLI tool.

Credentials

Only one credential is requested (MINERU_TOKEN) which is proportional for a remote MinerU service. The SKILL.md's mention that some quick extraction works without a token suggests the token may not be strictly required for all operations; metadata requiring it unconditionally is slightly overbroad but not a strong red flag.

Persistence & Privilege

always is false, the skill is user-invocable, and it does not request to modify other skills or system-wide configs. It only requires presence of the mineru-open-api binary.

Assessment

This skill appears coherent and does what it claims: it runs the MinerU CLI against .doc/.docx files and uses a MINERU_TOKEN for authenticated extracts. Before installing: (1) Confirm you trust the npm package name and the GitHub repo (inspect the repo/source if you can). (2) Understand that documents processed by the CLI may be sent to MinerU servers when using the authenticated 'extract' mode — avoid sending highly sensitive documents unless you’ve verified the service’s privacy/security. (3) If you only need quick, local/no-token extraction, check whether 'flash-extract' actually operates without a token in your environment. (4) Prefer installing in a sandbox or container first and verify behavior and network activity if you have strict security requirements.

Analyze and extract structured content from Word (.doc/.docx) files using MinerU. Returns Markdown with layout, headings, and structure preserved.

Install

npm install -g mineru-open-api
# or via Go (macOS/Linux):
go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest

Quick Start

# Analyze a .docx file (requires token)
mineru-open-api extract report.docx -o ./out/

# Analyze a .doc file (requires token)
mineru-open-api extract report.doc -o ./out/

# Specify language
mineru-open-api extract report.docx --language en -o ./out/

Authentication

Token required:

mineru-open-api auth             # Interactive token setup
export MINERU_TOKEN="your-token" # Or via environment variable

Create token at: https://mineru.net/apiManage/token

Capabilities

• Supported input: .doc, .docx (local file or URL)
• Preserves document structure: headings, paragraphs, lists, tables
• Requires token (mineru-open-api auth or MINERU_TOKEN env)
• Language hint with --language (default: ch, use en for English)

Notes

• .doc (legacy Word format) is only supported by extract (requires token)
• .docx supports both flash-extract (no token, quick) and extract (full features)
• Output goes to stdout by default; use -o <dir> to save to a file or directory
• All progress/status messages go to stderr; document content goes to stdout
• MinerU is open-source by OpenDataLab (Shanghai AI Lab): https://github.com/opendatalab/MinerU