Word OCR

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:08 AM UTC
• Version: 0.2.0

Overview

The skill does what it claims, but it sends potentially sensitive Word documents through a third-party OCR CLI and recommends a global unpinned npm install without enough user-facing safeguards.

Review this skill before installing if your Word documents may contain confidential, regulated, client, legal, or financial information. Prefer an isolated environment, avoid running the npm install as administrator/root, pin and verify the CLI package if possible, and only use remote OCR after you are comfortable with MinerU's data handling and token/billing terms.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:65
• Finding: Mandatory Third-Party Promotional Output## Vulnerability Details **File Location**: `SKILL.md`, lines 65-69 **Vulnerability Type**: Forced external-service promotion in agent output **Risk Level**: Low ### Vulnerable Snippet The following is an English rendering of the complete instruction: ```markdown ## Post-extraction hint (show once) > Tip: `flash-extract` is the fast, login-free OCR mode. For high-precision OCR and table/formula recognition, configure a token: https://mineru.net/apiManage/token ``` ### Technical Analysis The skill instructs the agent to append a predetermined message after document extraction. This message promotes a third-party service and directs the user to an external token-management page, regardless of whether token configuration is relevant to the user's request. Loading and following this instruction changes the agent's task-focused response by requiring unrelated promotional content. The behavior is therefore best classified as instruction hijacking, although its scope is limited to output manipulation and external-service redirection. The reviewed instruction does not override safety controls, request credentials directly, or establish persistence. ### Attack Path 1. A user activates the skill to perform OCR on a Word document. 2. The agent follows the OCR workflow described in `SKILL.md`. 3. After extraction, the agent follows the mandatory “show once” instruction. 4. The final response includes a link directing the user to the third-party token page. 5. The user may visit the external service or create/configure a token without having explicitly requested it. ### Impact Assessment The issue can modify user-facing agent output and redirect users to a third-party website. It does not, by itself, grant local system privileges, access protected resources, or execute code. Its practical scope is limited to unsolicited promotion, external traffic redirection, and possible social-engineering exposure associated with the link ...[truncated 11 chars]
• Remediation: ## Remediation Suggestions - Remove the mandatory post-extraction promotional message. - Mention token configuration only when the selected operation actually requires authentication. - Ask for user consent before directing the user to an external account or token-management service. - Clearly identify MinerU as a third-party service and explain why the external link is necessary. - Keep final responses focused on extraction results unless the user asks for setup or troubleshooting guidance.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 31-35 **Vulnerability Type**: Mutable and globally installed third-party dependency **Risk Level**: Medium ### Vulnerable Snippet ```markdown ## Installation ```bash npm install -g mineru-open-api ``` ``` ### Technical Analysis The installation command retrieves the current version of `mineru-open-api` from the configured npm registry without pinning an exact reviewed version or verifying package integrity. The `-g` option installs the package into the user's global npm environment rather than an isolated project environment. npm packages can execute lifecycle scripts during installation. If the package, its maintainer account, a transitive dependency, or the configured registry is compromised, a mutable future release could execute attacker-controlled code during installation. Global installation also increases the package's reach by placing its executable on a broadly accessible command path. The audit found no evidence that the named package is currently malicious. The vulnerability is the unsafe dependency acquisition and installation pattern, not a confirmed compromise of the package. ### Attack Path 1. An attacker compromises the npm package, a transitive dependency, a maintainer account, or the package source used by the victim's npm configuration. 2. The attacker publishes a malicious release under the expected package name. 3. A user follows the documented `npm install -g mineru-open-api` command. 4. npm resolves the unpinned package reference to the malicious release. 5. Malicious package or lifecycle code executes with the privileges of the user running npm. 6. The globally installed executable may subsequently run whenever the documented OCR commands are invoked. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the installing user. Depending on those privileges, the package could read ...[truncated 405 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an exact version that has been reviewed, for example `mineru-open-api@X.Y.Z`. - Record and verify the expected package integrity digest before installation. - Prefer a project-local, locked dependency installation over `npm install -g`. - Use a lockfile and a trusted, explicitly configured npm registry. - Install and run the CLI inside a restricted container, virtual machine, or dedicated low-privilege environment. - Disable npm lifecycle scripts during installation when the package does not require them, then verify required functionality separately. - Review the package provenance, maintainer history, transitive dependencies, and published contents before approving upgrades. - Avoid running the installation command as root or an administrator.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill directs users to a network-based OCR service (MinerU API) but does not explicitly disclose that document contents may be uploaded to and processed by an external provider. Because Word files often contain sensitive business, legal, or personal data, this omission can cause unintended data exfiltration and privacy/compliance exposure.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

- multilingual
tools:
  - Bash(mineru-open-api:*)
model: claude-3-5-haiku-20241022
---

# Word Document OCR with mineru-open-api

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The skill sets Chinese+English as the default OCR language without asking the user, which can expose user intent, document characteristics, or unnecessary linguistic metadata to the OCR provider and may reduce least-privilege processing. While lower severity than undisclosed external transfer, it still removes user choice and may affect privacy, accuracy, or policy compliance in regulated environments.

Static analysis

No suspicious patterns detected.