Word Parser

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:12 AM UTC
• Version: 0.2.0

Overview

This is a straightforward Word-document parsing skill, with visible reliance on MinerU and a third-party CLI, but users should treat documents as potentially sent to an external service.

Before installing, confirm you trust the mineru-open-api npm package and the MinerU service, avoid sensitive Word files unless external processing is permitted, and consider using a pinned or isolated install instead of a global latest-version install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 28–32 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ```bash ## Installation ```bash npm install -g mineru-open-api ``` ``` ### Technical Analysis The skill instructs users or agents to install `mineru-open-api` globally without specifying a reviewed version, package integrity hash, lockfile, or verified source. Consequently, the installed package contents may change after the skill itself has been audited. npm packages can execute lifecycle scripts during installation. If the referenced package, one of its transitive dependencies, or its distribution channel is compromised, running this command could execute attacker-controlled code with the privileges of the user performing the installation. The `-g` option increases exposure by placing the package and its executable entry points in the global npm environment rather than an isolated project directory. ### Attack Path 1. An attacker compromises the `mineru-open-api` npm package, a transitive dependency, or the relevant package publishing account. 2. The attacker publishes a malicious version containing an installation lifecycle script or modified executable. 3. A user or agent follows the skill instructions and runs `npm install -g mineru-open-api`. 4. npm resolves the unpinned dependency to the malicious release. 5. Malicious lifecycle code can execute during installation, or the modified CLI can execute when a subsequent parsing command is run. 6. The payload operates with the privileges and filesystem access of the account that invoked npm. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the installing user's account. This may expose files, environment variables, credentials accessible to that account, and documents later supplied to the globally installed CLI. It could also modify the user's global npm en ...[truncated 241 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to a specifically reviewed version, such as `mineru-open-api@<approved-version>`, rather than resolving the latest available release. - Record and verify package integrity using an npm lockfile and registry-provided integrity metadata. - Document the expected official registry, publisher, and source repository so package identity can be verified before installation. - Prefer a project-local, isolated installation over `npm install -g`, and invoke it through a controlled package script or a pinned `npx` workflow that does not silently select an unreviewed version. - Review the package and its transitive dependencies for lifecycle scripts. Where operationally feasible, install with lifecycle scripts disabled and explicitly run only reviewed setup steps. - Execute document-processing tools in a sandbox or container with minimal filesystem, network, environment-variable, and credential access. - Establish an update-review process so new package versions are security-reviewed before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to parse Word documents via the MinerU API/CLI but does not warn that document contents may be transmitted to an external service during processing. Because Word files often contain sensitive business or personal data, this omission can cause users to disclose confidential content without informed consent.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

- data-extraction
tools:
  - Bash(mineru-open-api:*)
model: claude-3-5-haiku-20241022
---

# Word Document Parser with mineru-open-api

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Static analysis

No suspicious patterns detected.