v1.0.0

Slides To Markdown

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:13 AM.

Analysis

The skill is coherent for converting Office documents to Markdown, but it does so by installing a third-party CLI and uploading documents to MinerU's cloud service.

GuidanceThis skill appears purpose-aligned and not suspicious based on the provided artifacts. Before installing, make sure you trust the mineru-open-api package and MinerU cloud service, and do not convert confidential documents unless their cloud processing and retention policy is acceptable to you.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

metadata

Install via npm / Install via uv / Install via go install ... package: mineru-open-api

The skill depends on installing an external CLI package. This is expected for the skill's purpose, but users are relying on the package source and installer provenance.

User impactInstalling the skill requires trusting the mineru-open-api package or direct download source.

RecommendationInstall only from the documented official source or a trusted package manager, and avoid unofficial mirrors.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceMediumStatusNote

SKILL.md

For larger files (up to 200MB/600 pages) or precision extraction, use `mineru-open-api extract` (requires auth via `mineru-open-api auth`)

The default workflow says no authentication is required, but the documentation also references an optional authenticated mode for larger files.

User impactIf you choose the larger-file workflow, the CLI may require account authentication with MinerU.

RecommendationUse the unauthenticated flash-extract path unless you intentionally need the larger-file mode, and review what account permissions the authenticated CLI receives.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL.md

`flash-extract` uploads the document to MinerU's cloud API for processing and returns the result.

The skill explicitly sends user documents to an external cloud service. This is aligned with the conversion purpose, but it matters because documents may contain sensitive information.

User impactPrivate documents converted with this skill may leave the local machine and be processed by MinerU's cloud service.

RecommendationOnly use it for documents you are comfortable uploading to MinerU, and review MinerU's privacy and retention terms before processing sensitive files.