Ocr Document

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:09 AM UTC
• Version: 1.0.0

Overview

This OCR skill is purpose-aligned and disclosed, but users should understand that it installs a third-party CLI and uploads documents to MinerU for processing.

Install only if you are comfortable using MinerU's third-party CLI and cloud OCR service. Avoid sending confidential documents unless MinerU's privacy terms meet your needs, and prefer a reviewed or pinned CLI version in controlled environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party CLI Dependencies Permit Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"openclaw":{"emoji":"🔍","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}}

Technical Analysis

The Skill permits installation of mineru-open-api through npm, uv, or Go without specifying an immutable version, commit hash, checksum, or signature. Consequently, installation resolves mutable content from an external package registry or source repository that was not included in the audited project.

If one of these distribution channels, package-owner accounts, repositories, or future releases is compromised, the installed package may contain attacker-controlled executable code. Package installation hooks or the resulting CLI binary could execute with the privileges of the Agent process. The use of several unpinned installation channels also expands the supply-chain attack surface and makes reproducible verification difficult.

No evidence establishes that the currently published packages are malicious. The risk arises from trusting mutable, unaudited dependency versions at installation time.

Attack Path

1. An attacker compromises a package maintainer account, registry release process, source repository, or another relevant dependency-distribution component.
2. The attacker publishes a malicious release under the expected mineru-open-api package or repository path.
3. The Agent installs the dependency using one of the unversioned installa ...[truncated 1061 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each installation method to a specific audited version. For Go installations, use an immutable release tag or commit identifier rather than an unresolved repository path.
2. Record and verify cryptographic checksums or trusted signatures for downloaded artifacts before execution.
3. Prefer one verified official distribution source instead of offering several independently mutable installation channels.
4. Review the selected release and its transitive dependencies before approving it for Agent use.
5. Use package-manager lockfiles where applicable and enforce reproducible installation in deployment workflows.
6. Disable package lifecycle scripts when they are unnecessary and supported by the package manager.
7. Perform installation and OCR processing in a sandbox or container with minimal filesystem, credential, and network access.
8. Establish an explicit dependency-update process so version changes require review and integrity verification.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction 'You MUST reply to the user in the SAME language they use. This is non-negotiable.' enforces a locale/language policy unconditionally. This removes user choice and is a natural-language policy violation unless the constraint is optional or clearly justified for a region-specific purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The 'When to Use' section includes generic phrases like 'scan', 'handwriting', and 'recognize text' that can overlap with ordinary conversation and may cause unintended skill activation. The file does not provide negative examples or tighter constraints to distinguish OCR-specific requests from broader document or image discussions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.