Pptx To Markdown

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:16 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed cloud-based office-document-to-Markdown converter, with privacy and supply-chain caveats users should understand before use.

Use this skill when you are comfortable uploading the document or URL to MinerU's cloud API for conversion. Avoid using it for confidential, regulated, or highly sensitive files unless you have approval, and install the CLI in a least-privilege environment from trusted package sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"📑","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}}

Technical Analysis

The installation metadata identifies npm, uv, and Go packages without pinning an exact version or immutable source commit. Consequently, installation may resolve to a mutable current release rather than the specific dependency revision reviewed by the project author.

The project contains no lockfile, integrity checksum, vendored dependency source, or other mechanism that independently verifies the installed executable. Because mineru-open-api is subsequently invoked to process local documents, compromise of its package registry entry, source repository, maintainer account, or a future upstream release could introduce malicious code into the installation or runtime path.

This finding does not establish that the current upstream package is malicious. It identifies a supply-chain weakness that permits the executable obtained during installation to differ from the version originally intended or reviewed.

Attack Path

1. An attacker compromises an upstream package publication channel, repository, or authorized maintainer account.
2. The attacker publishes a malicious release under the dependency name referenced in SKILL.md.
3. A user or agent installs the dependency through the unpinned npm, uv, or Go installation option.
4. The package manager resolves ...[truncated 793 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each dependency to an exact, reviewed release instead of allowing installation of a mutable latest version.
• For the Go installation source, reference an immutable reviewed commit or exact module version.
• Supply and enforce package integrity hashes or equivalent provenance verification where supported.
• Add appropriate lockfiles or reproducible dependency manifests to the project.
• Verify that all referenced packages originate from the expected official publisher and repository.
• Review dependency source and release artifacts before updating pinned versions.
• Prefer signed releases and verified provenance attestations where available.
• Run installation and document conversion with least privilege in an isolated environment, without unnecessary credentials or filesystem access.
• Establish a controlled update process that performs security review and integrity verification before changing dependency pins.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill’s invocation guidance is overly broad, matching generic user intents like reading, extracting, summarizing, or analyzing office documents. Because the skill uploads files or URLs to a third-party cloud API without authentication, this can cause the agent to route sensitive user documents to an external service more often than users expect, increasing privacy and data exposure risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.