ClawHub
Back to skill

Security audit

Academic Reader

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clear PDF-to-Markdown wrapper for MinerU, with disclosed document upload to a third-party service and ordinary supply-chain cautions.

Install this only if you are comfortable sending selected PDFs or PDF URLs to MinerU for processing. For sensitive documents, confirm before upload; for stronger supply-chain control, prefer a reviewed pinned CLI version or verified artifact, and avoid `mineru-open-api auth` unless you need the larger authenticated workflow.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding
Unpinned Third-Party CLI Installation Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 60 **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"📄","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}} ``` ```markdown - If the CLI cannot be installed via npm/uv/go, download it from https://mineru.net/ecosystem?tab=cli ``` ### Technical Analysis The skill offers npm, uv, and Go installation methods without pinning `mineru-open-api` to a reviewed immutable version, release tag, commit hash, or artifact digest. These installation definitions therefore resolve to whatever package version is available from the relevant upstream source at installation time. The fallback download instruction also does not specify an exact artifact, cryptographic checksum, or signature-verification procedure. Consequently, the executable installed in the future may differ from the component that was present when the skill was reviewed. This creates a supply-chain exposure: compromise of an upstream package-publishing account, repository, distribution server, or release artifact could cause installation of attacker-controlled code. The audit found no evidence that the currently referenced project or package is malicious; the vulnerability is the absence of dependency pinning and integrity verification. ### Attack Path 1. An attacker compromises an upstream package account, source repository, release pipeline, or download endpoint used to distribute `mineru-open-api`. 2. The attacker publishes or subs ...[truncated 1099 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin each supported installation source to a specific reviewed release: - Specify an exact npm package version. - Specify an exact Python package version for uv. - Pin the Go module to an immutable tagged version or reviewed commit. 2. Record and verify SHA-256 or stronger hashes for downloaded release artifacts. 3. Prefer signed releases and document signature verification against a trusted maintainer key. 4. Replace the generic website-download instruction with an exact HTTPS artifact URL, version, expected digest, and verification commands. 5. Use lockfiles or an equivalent dependency-locking mechanism where the skill platform supports them. 6. Periodically review and deliberately update pinned versions after security and provenance checks rather than automatically consuming the latest release. 7. Run the converter with least privilege and isolate it from unrelated credentials and sensitive files. 8. Obtain user approval before uploading sensitive documents to the disclosed external MinerU service. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill recommends activation on broad verbs like "read," "extract," "convert," "parse," "summarize," and "analyze," which can cause the agent to invoke this skill in many contexts beyond explicit PDF-conversion intent. Because this skill sends documents or URLs to a third-party API, overbroad triggering increases the risk of unintended data exfiltration, especially when users ask to summarize sensitive PDFs or linked documents.

Static analysis

No suspicious patterns detected.