PDF to Text

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:11 AM UTC
• Version: 0.2.0

Overview

The skill is purpose-aligned for PDF text extraction, but it needs review because it installs an unpinned global npm CLI and does not clearly disclose third-party document processing or persistent extracted-text output.

Review before installing. Use this only with PDFs approved for third-party processing, prefer a pinned and local CLI installation, avoid running npm with elevated privileges, and choose an explicit output directory that you can clean up after extraction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-38
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown

## Installation

```bash
npm install -g mineru-open-api

text

### Technical Analysis

The skill directs the agent to install `mineru-open-api` globally without specifying an exact version, lockfile, or package integrity hash. Consequently, the installed code is determined by whichever package version the npm registry resolves at execution time rather than the version reviewed during the skill audit.

npm packages and their transitive dependencies may execute lifecycle scripts during installation. If the package, an upstream maintainer account, or a transitive dependency is compromised, a malicious release could execute arbitrary commands while this instruction is followed. Global installation also broadens exposure by placing package files and executable entry points into a shared system or user-level npm location.

The audited project does not itself contain a malicious payload, and no compromise of `mineru-open-api` was established. The finding concerns the unsafe, mutable dependency installation process.

### Attack Path

1. An attacker compromises the `mineru-open-api` package, its publisher account, or a transitive dependency.
2. The attacker publishes a malicious version that is selected as the current npm release.
3. An agent follows the skill instruction and runs `npm install -g mineru-open-api`.
4. npm downloads the unreviewed release and its dependency tree.
5. Malicious package code or an installation lifecycle script executes with the privileges of the user running npm.
6. The installed global executable may continue executing attacker-controlled behavior whenever subsequent extraction commands are invoked.

### Impact Assessment

Successful exploitation could provide arbitrary code execution with the priv
...[truncated 427 chars]

Remediation

View remediation

Remediation Suggestions

• Pin mineru-open-api to an exact, reviewed version instead of resolving the latest release.
• Record and verify package integrity using a lockfile and npm integrity metadata.
• Prefer a project-local installation such as npm install --save-exact mineru-open-api@<reviewed-version> over global installation.
• Run the package in a restricted container or sandbox with only the PDF input and designated output directory mounted.
• Disable npm lifecycle scripts during installation where compatible, and separately review any scripts required by the package.
• Audit the package's transitive dependency tree and monitor the pinned version for security advisories.
• Avoid installing with administrator or root privileges and restrict access to secrets and unrelated filesystem locations during extraction.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is built around the MinerU API/CLI, but it does not warn users that PDF contents may be transmitted to a third-party service for processing. Because PDFs often contain confidential or regulated data, omission of this disclosure can lead users to unknowingly exfiltrate sensitive information outside the local environment.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

- data-processing
tools:
  - Bash(mineru-open-api:*)
model: claude-3-5-haiku-20241022
---

# PDF to Text Extraction with mineru-open-api

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs use of a generated default output directory, but it does not tell the user that files will be created on disk or where extracted document contents will be stored. For PDF text extraction, this can silently persist sensitive material locally, increasing the chance of unintended disclosure through shared machines, backups, or later reuse of the directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The post-extraction hint is written in Chinese, while the rest of the skill is in English, and there is no indication that users can choose their preferred language. This can violate language/locale policy expectations by forcing a specific language for part of the interaction without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.