Pdf2md

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.0

Overview

This PDF conversion skill is coherent, but it can upload local PDFs to an external service under broad triggers without a clear consent step.

Install only if you are comfortable with PDFs being processed by MinerU's external API. Avoid using it on confidential, regulated, privileged, or personal documents unless you are authorized to disclose them, and prefer a local-only converter for sensitive files. Treat the CLI install as mutable third-party code unless you pin and review a specific version yourself.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned Third-Party CLI Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml metadata: {"openclaw":{"emoji":"📄","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}} ``` ### Technical Analysis The skill provides three installation methods for `mineru-open-api`, but none specifies a fixed version, immutable commit, checksum, or cryptographic signature: - The npm package is referenced only by package name. - The uv package is referenced only by package name. - The Go package is referenced by a mutable repository path without a version or commit. Consequently, installation resolves whatever package version or repository state the upstream source serves at that time. That effective code was not included in the audited project and can change independently after review. This creates a supply-chain risk. If a package registry, source repository, release process, or maintainer account is compromised, a malicious future release could be delivered through the legitimate installation instructions. Package installation hooks or later execution of the installed CLI could then run attacker-controlled code. ### Attack Path 1. An attacker compromises an upstream package publisher, repository, release process, or associated maintainer account. 2. The attacker publishes a malicious version of `mineru-open-api` under the expected package name or repository path. 3. A user or agent activates the skill on a system where the required binary is unavailable. 4. The skill i ...[truncated 888 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm and Python/uv dependencies to exact, reviewed versions rather than resolving the latest release. 2. Pin the Go dependency to an immutable reviewed release or commit. 3. Record and verify package checksums or cryptographic signatures where supported. 4. Use lockfiles or equivalent dependency manifests to constrain transitive dependencies. 5. Verify that each package originates from the expected publisher and source repository. 6. Disable package installation scripts where practical, or review them before allowing execution. 7. Execute the converter with minimal filesystem and network permissions, preferably in an isolated container or sandbox. 8. Establish a controlled update process in which new dependency versions are reviewed before pins are changed. ]]>

other

Warning

• Location: SKILL.md:17
• Finding: PDF Upload to an External Service Without an Explicit Consent Gate<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-27, 50` **Vulnerability Type**: External disclosure of user-provided document contents **Risk Level**: Medium ### Vulnerable Code Snippet ```bash # PDF to Markdown - Quick & Free mineru-open-api flash-extract report.pdf # PDF to Markdown - Quick & Free mineru-open-api flash-extract https://cdn-mineru.openxlab.org.cn/demo/example.pdf # PDF to Markdown - Quick & Free mineru-open-api flash-extract report.pdf -o ./output/ # PDF to Markdown - Quick & Free mineru-open-api flash-extract report.pdf --pages 1-10 ``` ```markdown ## Data Flow `flash-extract` sends the document to the MinerU API (mineru.net) for processing and returns Markdown. This is a stateless API call — no account, no persistent storage. MinerU is an open-source project by OpenDataLab (Shanghai AI Lab): https://github.com/opendatalab/MinerU ``` ### Technical Analysis The primary workflow invokes `flash-extract` on a local PDF. The skill explicitly states that the command sends the document to the MinerU API at `mineru.net` for processing. Thus, local document contents leave the user's environment and are disclosed to an external service. Although the data flow is documented later in the file, the operational instructions do not require the agent to: - Warn the user immediately before transmission. - Identify the external recipient at the decision point. - Obtain explicit consent to upload the selected document. - Check whether the document contains confidential or regulated information. - Offer a local-only processing alternative. The assertion that the API is stateless and uses no persistent storage is documentation supplied by the skill and cannot be independently verified from the single audited file. Even without persistent storage, transmitting a document exposes its contents to an external processing environment and associated network infrastructure. ### Attack Path 1. A user supplies a local PDF and requests conve ...[truncated 1132 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user consent immediately before any local file is uploaded. 2. State clearly that the PDF will be transmitted to `mineru.net` and identify whether the entire file or only selected pages will be sent. 3. Warn users not to upload confidential, regulated, privileged, or personally identifiable information unless they are authorized to disclose it. 4. Provide a local-only PDF extraction option for sensitive documents. 5. Apply data minimization by sending only the necessary page range. 6. Display the external-processing warning near the Quick Start commands rather than only in a later data-flow section. 7. Document the service's privacy policy, retention policy, processing region, transport protections, and deletion guarantees. 8. Treat claims concerning stateless processing and lack of persistent storage as external assurances unless independently verified. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill's 'When to Use' section uses very broad trigger phrases such as 'read', 'extract', 'convert', 'parse', 'summarize', or 'analyze' a PDF, which can match a wide range of ordinary user requests. This increases the chance the agent will invoke the skill automatically and send local files or remote URLs to an external API without sufficiently explicit user intent or data-sensitivity checks.

Static analysis

No suspicious patterns detected.