Pic2md

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:16 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent OCR helper that discloses cloud image processing, with supply-chain and privacy cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable using MinerU's cloud service for OCR. Do not process confidential, regulated, or private images without checking the service terms, and prefer a pinned or otherwise verified CLI release when available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned executable dependencies from external package registries and repositories
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"🖼️","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}}

Technical Analysis

The installation metadata permits the mineru-open-api executable to be installed from npm, a Python package source through uv, or a Go repository. None of these installation options specifies a reviewed package version, immutable commit, artifact checksum, or signature.

Consequently, installation can resolve to a package version that differs from the version originally reviewed. If a package registry account, upstream repository, release pipeline, or package publisher is compromised, an attacker could distribute modified installation or runtime code without changing this Skill. Package installation hooks and the installed executable may then run with the privileges granted to the Agent or installation process.

This finding does not establish that the current upstream packages are malicious. It identifies a supply-chain weakness caused by trusting mutable, unverified dependency references.

Attack Path

1. An attacker compromises an upstream package publisher, registry account, source repository, or release pipeline associated with one of the declared installation sources.
2. The attacker publishes a malicious version of mineru-open-api or modifies the mutable upstream source.
3. A user or Agent insta ...[truncated 1247 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every installation option to a specifically reviewed release:
   • Use an exact npm package version rather than an unconstrained package name.
   • Use an exact Python package version for installation through uv.
   • Pin the Go dependency to an immutable tagged version or commit.
2. Enforce artifact integrity using lockfiles, registry integrity metadata, cryptographic checksums, or verifiable release signatures.
3. Confirm and document the canonical package publisher and repository for every ecosystem to reduce dependency-confusion and impersonation risks.
4. Review each pinned artifact and repeat the security review before updating its version.
5. Disable automatic dependency installation where feasible and require explicit user approval before installing or upgrading executable packages.
6. Perform installation and execution with least privilege in a sandbox or restricted environment with only the filesystem and network access required for OCR.
7. Avoid processing sensitive or regulated images unless the user explicitly consents to uploading them to the documented third-party cloud service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The mandatory instruction to always reply in the user's language removes user choice and can override higher-level product behavior or accessibility preferences. While not directly enabling code execution or data exfiltration, hardcoded behavioral constraints in a skill can create policy conflicts and reduce safe, predictable orchestration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation guidance uses very broad verbs like 'read' and 'extract' for images without clear exclusion criteria, which can cause the skill to trigger on ordinary user requests that do not specifically require this external OCR tool. Because the skill uploads images to a third-party cloud API, overbroad activation increases the chance of unnecessary data disclosure and unintended routing of sensitive screenshots or documents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.