Slides To Markdown

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:16 AM UTC
• Version: 1.0.0

Overview

This is a straightforward document-to-Markdown skill, but users should know it uploads documents to MinerU's cloud service for processing.

Install only if you are comfortable sending selected office documents to MinerU's cloud API. Avoid using it for confidential documents unless you have reviewed MinerU's privacy terms, and prefer a pinned or reviewed CLI version where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party CLI Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party dependencies resolved from external package registries and repositories
Risk Level: Medium

Vulnerable Code Snippet

yaml

metadata: {"openclaw":{"emoji":"📑","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}}

Technical Analysis

The npm and uv installation definitions identify mineru-open-api without specifying a reviewed version or integrity hash. The Go installation definition similarly references a repository package without an immutable release version or commit hash.

Consequently, installation can resolve mutable upstream content at the time the skill is installed. If a package registry account, repository, release process, or other upstream supply-chain component is compromised, a modified dependency could execute code during installation or when the CLI is invoked. The project contains no evidence that the current dependency is malicious; the vulnerability is the absence of controls that ensure the installed artifact is the same artifact that was audited.

Attack Path

1. An attacker compromises an upstream package, maintainer account, repository, or release pipeline associated with mineru-open-api.
2. The attacker publishes a malicious package version or modifies the repository state resolved by the unpinned installation instruction.
3. A user or agent installs the skill dependency through npm, uv, or Go.
4. The package manager retrieves the attacker-controlled version because no immutable version, commit, checksum, or signature is ...[truncated 850 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm and uv dependencies to specific, reviewed versions rather than resolving the latest available release.
2. Pin the Go dependency to a reviewed semantic version or immutable commit hash.
3. Record and verify package checksums, lockfile integrity data, or cryptographic signatures where supported.
4. Configure installation to use trusted registries and reject unexpected registry substitutions or unverified download sources.
5. Review package provenance and release signatures before updating pinned versions.
6. Perform dependency updates through a controlled review process that includes source comparison and malware scanning.
7. Run installation and document conversion in a sandbox with minimal filesystem access, restricted environment variables, and constrained network permissions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill’s activation criteria are overly broad, using common user intents like "read," "extract," "convert," "summarize," and "analyze" for common office document types without tighter constraints. This can cause the agent to invoke a cloud-uploading tool in situations where the user did not explicitly consent to external processing, increasing the risk of unintended data exfiltration of sensitive document contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file states, 'You MUST reply to the user in the SAME language they use. This is non-negotiable.' This imposes a strict language policy rather than offering user choice or opt-in, which matches the policy-violation category for forced language behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.