ClawHub
Back to skill

Security audit

Summarize Pdf

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward PDF-to-Markdown helper, but users should understand that documents are sent to MinerU and the CLI dependency is installed from mutable third-party sources.

Install this only if you are comfortable using MinerU's CLI and uploading the PDFs you process to MinerU's API. For sensitive documents, avoid this skill unless the data-sharing terms are acceptable, and prefer pinned or reviewed CLI versions when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party CLI Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party dependencies from external package registries and a mutable source repository
Risk Level: Medium

Vulnerable Code Snippet

yaml
metadata: {"openclaw":{"emoji":"📄","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}}

Technical Analysis

The Skill offers npm, uv, and Go installation sources without specifying a reviewed version, immutable commit, checksum, or signature. Consequently, installation may resolve to mutable third-party content that was not present in the audited project.

This creates a supply-chain trust gap. If a package registry account, distribution channel, upstream repository, or future release is compromised, the dependency could introduce malicious installation hooks or runtime behavior. The audit found no evidence that the currently published dependency is malicious; the issue is the absence of controls that ensure Agents install the same reviewed artifact.

Attack Path

  1. An attacker compromises an upstream publisher account, registry artifact, repository, or release process.
  2. The attacker publishes a malicious version under the referenced package name or modifies the mutable upstream source.
  3. An Agent installs mineru-open-api using one of the unpinned installation entries.
  4. The package manager retrieves the attacker-controlled release rather than a previously reviewed artifact.
  5. Malicious installation hooks or CLI runtime code execute with the privileges of the Agent user.

Impact Assessment

Successful exploi ...[truncated 484 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin each installation method to a specific, reviewed release.
  • For Go installation, use an immutable semantic version or audited commit hash rather than an unversioned repository path.
  • Use lockfiles and integrity metadata for npm and uv-compatible distributions where supported.
  • Publish and verify cryptographic checksums or signatures for distributed binaries.
  • Restrict dependency retrieval to approved registries and repositories.
  • Add automated dependency scanning and controlled update procedures.
  • Review new versions before updating pins, and test installations in a sandbox with minimal filesystem and network permissions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.