Smart PDF Reader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:18 AM UTC
• Version: 0.2.0

Overview

This PDF-reading skill is coherent, but it can process sensitive documents through an external MinerU-based CLI without clear confirmation or privacy disclosure, and it recommends a mutable global npm install.

Review this carefully before installing. Use it only for PDFs you are comfortable processing with MinerU-related tooling, avoid confidential documents unless you understand the service's data handling, and prefer a pinned, local, sandboxed installation over the recommended global npm install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 31
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Complete Code Snippet:

bash

npm install -g mineru-open-api

Technical Analysis

The installation command retrieves the current release of mineru-open-api without specifying an exact version, lockfile, or package integrity value. This makes the code ultimately installed mutable and prevents users from reliably reproducing a reviewed dependency set.

npm packages can execute lifecycle scripts during installation. If the package, its publishing account, or one of its transitive dependencies is compromised, a malicious release could execute code with the privileges of the user running npm. The -g option increases exposure by modifying the user's global npm environment rather than installing the package in an isolated, project-specific context.

The audit did not establish that the named package is malicious. The confirmed issue is the unsafe dependency acquisition and installation practice.

Attack Path

1. An attacker compromises the package publisher, a relevant dependency, or the package distribution channel.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the Skill's installation command, which requests the latest available release because no exact version is specified.
4. npm downloads the attacker-controlled package or transitive dependency.
5. Malicious lifecycle scripts can execute during installation, or malicious package logic can execute when the CLI is subsequently invoked.
6. The payload operates with the installing or invoking user's effective permissions.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the affected user's account. The resulting access could include reading or altering files available to that user, modifying the globa ...[truncated 309 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact, reviewed version instead of implicitly installing the latest release.
• Verify the package's official publisher, source repository, release provenance, and expected package name before installation.
• Use a project-local dependency with a committed lockfile rather than npm install -g.
• Enforce package integrity and provenance verification in the installation workflow.
• Review transitive dependencies and npm lifecycle scripts before approval.
• Run the CLI in a restricted container or sandbox with access limited to the intended input PDF and output directory.
• Disable installation scripts where operationally possible, then explicitly review any functionality that requires them.
• Establish a controlled upgrade process so new versions are security-reviewed before adoption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are very broad and overlap with common document-help requests, which increases the chance of unintended invocation. In this skill, accidental activation is more concerning because using the tool may send user-provided PDFs to an external extractor, potentially exposing sensitive document contents without clear user awareness.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- document-review
tools:
  - Bash(mineru-open-api:*)
model: claude-3-5-haiku-20241022
---

# Smart PDF Reader with mineru-open-api

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to process PDFs with mineru-open-api but does not clearly warn that document contents may be transmitted to an external service/tool. Because PDFs often contain sensitive financial, legal, academic, or personal information, this omission can cause users to disclose confidential data without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.