AI PDF Converter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:12 AM UTC
• Version: 0.2.0

Overview

This PDF conversion skill has a coherent purpose, but it directs users to install an unpinned global third-party CLI and process potentially sensitive PDFs through MinerU without clear privacy or consent guidance.

Review this skill before installing. It appears intended for legitimate PDF conversion, but use caution with confidential PDFs because the artifact does not clearly state where document contents are processed or retained. Prefer a pinned, locally installed, sandboxed version of the CLI and avoid legal, financial, medical, or proprietary documents unless you have confirmed MinerU's data-handling terms.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Globally Installed Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–34
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Complete Code Snippet:

markdown

## Installation

```bash
npm install -g mineru-open-api

text

### Technical Analysis

The skill directs the agent to install `mineru-open-api` from the npm registry without specifying an exact version, integrity hash, or lockfile. Dependency resolution can therefore select a package release that was not available during the skill audit and whose behavior may differ from the reviewed expectations.

The `-g` option installs the package globally rather than isolating it within the project. During installation, npm may execute package lifecycle scripts with the permissions of the invoking user. The installed CLI is subsequently run against user-supplied PDFs, including potentially confidential documents. The project contains no dependency source, checksum, endpoint configuration, or privacy documentation with which to verify the package's installation behavior or its treatment of document data.

### Attack Path

1. An attacker compromises the npm package, a maintainer account, or a future package release.
2. The agent follows the skill instruction and runs `npm install -g mineru-open-api`.
3. npm resolves and downloads the unpinned release.
4. Malicious package code or lifecycle scripts execute with the invoking user's permissions.
5. The globally installed CLI is invoked on user-selected PDFs.
6. Malicious code can access data available to that user, including input documents, and may transmit it externally or alter generated output.

This path depends on compromise or malicious publication of the external dependency; no malicious implementation is included in the audited project itself.

### Impact Assessment

Successful exploitation could provide code execution under the invoking user's account. The accessible s
...[truncated 415 chars]

Remediation

View remediation

Remediation Suggestions

• Pin mineru-open-api to a reviewed, exact version rather than resolving the latest release.
• Record and verify the package integrity value through a lockfile or equivalent checksum mechanism.
• Prefer a project-local installation over global installation to reduce scope and improve reproducibility.
• Review the package source, transitive dependencies, and lifecycle scripts before approval.
• Disable npm lifecycle scripts where compatible; otherwise document and review every required script.
• Run conversion in a sandbox or container with minimal filesystem access, restricted credentials, and limited network access.
• Document the remote API endpoints, authentication requirements, data retention policy, and whether input PDFs are uploaded.
• Require explicit user consent before transmitting sensitive documents to an external service.
• Maintain an allowlist of approved package versions and periodically reassess them for known vulnerabilities or ownership changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill routes user PDFs through the MinerU API/CLI for conversion but does not disclose that document contents may be transmitted to an external service. Because the described use cases include sensitive documents such as legal contracts, financial reports, and multilingual scanned records, users could unknowingly expose confidential data to a third party.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- vlm
tools:
  - Bash(mineru-open-api:*)
model: claude-3-5-haiku-20241022
---

# AI PDF Converter with mineru-open-api

Static analysis

No suspicious patterns detected.