Word To Markdown

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:32 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Office-document-to-Markdown helper, but users should understand it installs an external CLI and uploads documents to MinerU for processing.

Install only if you trust the MinerU CLI distribution path you choose, and use it only with documents you are comfortable sending to MinerU's cloud API. For sensitive business, legal, or personal files, prefer an isolated environment or a locally processed alternative.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party CLI Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"📑","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}}

Technical Analysis

The skill offers three installation methods for mineru-open-api, but none identifies an immutable, reviewed release. The npm and Python package references omit version constraints, while the Go module reference omits a version or commit. Consequently, installation can resolve to whatever release the upstream registry or repository serves at that time.

This creates a supply-chain risk because the installed code may differ from the code originally evaluated with the skill. A compromised maintainer account, malicious package release, repository compromise, or unexpected upstream change could introduce executable behavior without any modification to this project.

The finding does not establish that the current upstream package is malicious. It identifies the absence of controls that would prevent a future altered release from being installed automatically.

Attack Path

1. An attacker compromises an upstream package publisher, registry account, source repository, or release process.
2. The attacker publishes a malicious version under the existing mineru-open-api package or module name.
3. A user or agent installs the dependency through one of the unpinned installation entries in SKILL.md.
4. The package manager resolves and installs the attacker-contr ...[truncated 913 chars]

Remediation

View remediation

Remediation Suggestions

• Pin npm and Python installations to specific, reviewed versions rather than resolving the latest available release.
• Pin the Go installation to a reviewed semantic version or immutable commit identifier.
• Use lockfiles and integrity hashes where the package ecosystem supports them.
• Verify package provenance, publisher identity, release signatures, and checksums before installation.
• Perform dependency and malware scanning on each approved release before updating the pinned version.
• Execute the converter with least privilege in an isolated environment that has access only to the document being processed and its designated output directory.
• Require explicit user consent before uploading sensitive documents to the external MinerU service.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.