Paper To Markdown

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:28 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed PDF-to-Markdown helper, but PDFs are sent to MinerU’s external service for processing.

Install only if you are comfortable trusting the mineru-open-api CLI and sending selected PDFs or PDF links to MinerU for processing. Avoid private or regulated documents unless that external data flow is acceptable, and only run MinerU authentication if you intentionally need the larger-file extraction mode.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The 'When to Use' section uses broad triggers like 'read', 'extract', 'convert', 'parse', 'summarize', or 'analyze a PDF', which can match many ordinary user requests and cause the skill to activate more often than intended. Because this skill sends documents or URLs to a third-party API, over-triggering can lead to unintended external transmission of user-provided content or metadata, increasing privacy and data-handling risk.

VirusTotal

65/65 vendors flagged this skill as clean.