Paper To Markdown

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.0

Overview

This PDF-to-Markdown skill is purpose-aligned and disclosed, but users should know it sends PDFs to MinerU's online service and installs an external CLI.

Install only if you are comfortable sending selected PDFs or PDF URLs to MinerU for conversion. For sensitive, private, regulated, or client documents, require explicit confirmation before use and prefer a pinned or sandboxed CLI install where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party Executable Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: Unpinned executable dependencies from multiple package ecosystems **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"📄","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}} ``` ### Technical Analysis The Skill allows the `mineru-open-api` executable to be installed through npm, uv, or Go without specifying a reviewed version, immutable source commit, or integrity hash. Consequently, installation may resolve to a package release that did not exist when the Skill was audited. Because the installed component is executable and processes user-supplied files, compromise of a package registry account, upstream repository, release process, or dependency chain could introduce arbitrary code into the Agent environment. Providing several mutable installation sources for the same binary name also increases provenance ambiguity and the supply-chain attack surface. This finding does not establish that the current upstream packages are malicious. Exploitation depends on a malicious or compromised future package version being resolved during installation. ### Attack Path 1. An attacker compromises an upstream package publisher, package registry account, source repository, or release pipeline associated with one of the configured installation sources. 2. The attacker publishes a malicious release under the expected package name or modifies the mutable upstream source. 3. The Agent installs `mineru-open-api` without enforcing a reviewed version, commit, or integr ...[truncated 1106 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every supported package source to a specifically reviewed version. For the Go source, use an immutable commit or release tag rather than a mutable default branch. 2. Enforce package integrity verification through registry lockfiles, checksums, signatures, or cryptographic digests where the installer supports them. 3. Prefer one verified installation source instead of offering several equivalent mutable sources for the same executable. 4. Verify publisher identity, package provenance, release signatures, and repository ownership before approving updates. 5. Test dependency updates in an isolated environment and require explicit review before changing pinned versions. 6. Run the converter in a sandbox or container with minimal filesystem permissions, restricted environment variables, and network access limited to the documented MinerU API endpoints. 7. Require explicit user confirmation before uploading confidential local documents to the remote conversion service. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill’s activation guidance is broad enough to match common user requests like reading, summarizing, or analyzing a PDF, which can cause the skill to trigger in situations where users may not expect their document or link to be sent to a third-party API. This is especially sensitive because the skill explicitly supports local files and URLs and its data flow states that documents are transmitted off-box for processing.

Static analysis

No suspicious patterns detected.