PDF Markdown Converter

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:12 AM UTC
• Version: 0.2.0

Overview

This skill is a straightforward PDF-to-Markdown helper, but users should install and run its MinerU CLI dependency carefully.

Before installing, prefer a pinned or project-local mineru-open-api install instead of a global latest-version install, avoid sudo, and run conversions only on PDFs you are comfortable sending through the MinerU API. Review the chosen output directory before batch conversions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35
• Finding: Unpinned Global npm Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 35–39 **Vulnerability Type**: Unpinned third-party package installed globally **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## Installation ```bash npm install -g mineru-open-api ``` ``` ### Technical Analysis The installation instructions retrieve and globally install the latest available release of `mineru-open-api`. No exact version, lockfile, package integrity hash, or verified source reference is specified. Consequently, the code installed and executed can change after the Skill has been reviewed. npm packages may execute lifecycle scripts during installation. If the package, one of its transitive dependencies, or its publisher account is compromised, malicious installation code could execute with the privileges of the user running npm. Global installation also increases exposure by making the executable available outside an isolated project environment. The repository does not establish that `mineru-open-api` is currently malicious. The vulnerability is the unsafe, mutable dependency installation process and the resulting supply-chain exposure. ### Attack Path 1. An attacker compromises the npm package, a transitive dependency, or a relevant publisher account, or causes a malicious release to become the version resolved by npm. 2. A user follows the Skill instructions and runs `npm install -g mineru-open-api`. 3. npm retrieves the mutable latest package and its dependency tree without a repository-provided lockfile or integrity verification. 4. Malicious package code can execute through npm lifecycle scripts during installation or when the installed CLI is invoked. 5. The malicious code operates with the invoking user's permissions and can access resources available to that user, including documents supplied for conversion. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges ...[truncated 500 chars]
• Remediation: ## Remediation Suggestions 1. Pin `mineru-open-api` to an exact, reviewed version rather than resolving the mutable latest release: ```bash npm install --save-exact mineru-open-api@<reviewed-version> ``` 2. Prefer a project-local installation over `npm install -g`, and invoke the binary from the local dependency environment. 3. Commit and enforce a lockfile so the complete transitive dependency graph and integrity metadata remain reproducible. 4. Document the package's official registry location and verify its publisher, provenance, signatures, and integrity before installation. 5. Review package lifecycle scripts and use `--ignore-scripts` when they are unnecessary and compatibility has been validated. 6. Run the converter in a sandbox or container with network, filesystem, and credential access restricted to the selected input PDF and designated output directory. 7. Perform dependency and malware scanning before approving version updates. Update pinned versions only through a controlled review process. 8. Warn users not to execute global npm installation with `sudo` or another elevated account.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

- content-migration
tools:
  - Bash(mineru-open-api:*)
model: claude-3-5-haiku-20241022
---

# PDF to Markdown Converter with mineru-open-api

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: This markdown file documents multiple conversion commands that create files in `./output/`, `./results/`, or a generated directory, but it does not explicitly warn users that running the skill will write data to disk. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect user data or system state.

Static analysis

No suspicious patterns detected.