PDF Markdown Converter

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  0.2.0

Overview

This is a straightforward PDF-to-Markdown skill, but users should remember it relies on a third-party MinerU API/CLI for document processing.

Install only if you are comfortable using the mineru-open-api npm package and sending PDFs to the MinerU service. Avoid confidential, regulated, or proprietary documents unless you have confirmed the service's privacy, retention, and credential requirements.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger list includes broad phrases such as 'can you convert this PDF to text format' and 'make this PDF editable', which can match user intents beyond straightforward PDF-to-Markdown conversion. This increases the chance the skill is invoked inappropriately, potentially causing unintended document upload to the external MinerU service and confusing users about what transformation will occur.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill routes user PDFs through the mineru-open-api service, but the description does not warn that document contents may be transmitted to an external API. Users may provide sensitive research papers, internal manuals, contracts, or regulated documents without informed consent, creating confidentiality, compliance, and data-handling risk.

VirusTotal

66/66 vendors flagged this skill as clean.