Excel To Markdown

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed document-to-Markdown converter that uses a named third-party cloud CLI, with supply-chain and privacy considerations users should understand.

Install only if you are comfortable sending supported Office documents to MinerU's cloud processing service. Avoid using it for sensitive, regulated, or confidential files unless you have reviewed MinerU's terms and trust the mineru-open-api package source; prefer a sandboxed environment for installation and conversion.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"📑","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}}

Technical Analysis

The installation metadata retrieves mineru-open-api from npm, a Python package source used by uv, or a Go module path without specifying a reviewed version or immutable revision. The project contains no lockfile, checksum, signature requirement, vendored source, or integrity constraint.

Consequently, the code installed in the future may differ from the code originally reviewed. A compromised maintainer account, package registry, release process, or upstream repository could cause installation to resolve to a malicious release. Package installation hooks or the resulting CLI could then execute attacker-controlled code. Because the CLI processes local office documents and communicates with an external service, a compromised version could also intercept document contents.

Attack Path

1. An attacker compromises an upstream package publisher, registry entry, release process, or source repository associated with mineru-open-api.
2. The attacker publishes malicious code under the same unpinned package or module identifier.
3. The skill framework attempts to satisfy the required binary and installs the dependency through npm, uv, or Go.
4. The package manager resolves the mutable identifier to the attacker-controlled release.
5. Malicious code runs during ...[truncated 811 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each installation method to an explicitly reviewed version:
   • Use an exact npm package version rather than an unconstrained package name.
   • Use an exact Python package version for uv.
   • Use an immutable Go module version or reviewed commit revision.
2. Commit appropriate lockfiles where the skill packaging format supports them.
3. Verify downloaded packages using registry integrity metadata, cryptographic checksums, or publisher signatures.
4. Document the expected package publisher, version, checksum, and source repository so substitutions can be detected.
5. Run installation and document conversion in a sandbox with minimal filesystem, environment, and network access.
6. Require explicit user consent before uploading potentially sensitive documents to the external processing service.
7. Establish a controlled dependency-update process that reviews and tests new versions before changing the pins.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill’s invocation guidance uses very broad phrases such as asking to 'read', 'extract', or 'convert' a document, which can match many ordinary user requests and cause the agent to invoke this skill too eagerly. In this skill’s context, over-triggering is more concerning because the tool uploads files or URLs to a third-party cloud API, creating an avoidable data exposure risk when users may have expected local handling or no external transfer.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.