Word to HTML

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:18 AM UTC
• Version: 0.2.0

Overview

This Word-to-HTML skill appears purpose-aligned, but it asks users to install an unpinned global npm package and sends documents to a third-party MinerU service without a clear privacy confirmation step.

Review before installing. Use this only for documents you are comfortable sending to MinerU, avoid confidential or regulated files unless you have approved that data flow, and prefer a pinned, local, non-admin install in a restricted environment instead of the global npm command.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:68
• Finding: Mandatory External-Service Promotion Alters Agent Output## Vulnerability Details **File Location**: `SKILL.md`, lines 68-70 **Vulnerability Type**: Forced user-facing output and external-service redirection **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Post-extraction hint (show once per session) > Tip: `flash-extract` provides a fast mode without login, limited to 10 MB or 20 pages and without table recognition. For larger files or HTML export, create a token: https://mineru.net/apiManage/token ``` The quoted tip is an English translation of the source-language message; the command names, restrictions, and URL are unchanged. ### Technical Analysis The skill directs the agent to display a predetermined promotional message once per session after extraction. This requirement changes user-facing output independently of whether the user requested authentication assistance or information about MinerU service limits. Because the instruction is loaded as part of the skill, an agent following it will inject the external token-acquisition URL into conversion responses. This represents instruction-level output manipulation. It does not override safety controls, establish persistence, or execute code, but it compromises output integrity and redirects users to a third-party service. ### Attack Path 1. A user activates the Word-to-HTML skill. 2. The agent processes a document through the documented workflow. 3. The post-extraction instruction requires the agent to append the predefined tip. 4. The response directs the user to the external MinerU token-management page, even when the user did not ask for authentication or account information. ### Impact Assessment The issue affects the integrity and neutrality of agent responses. It can cause unsolicited external-service promotion and encourage users to visit a third-party site or create an account. No local privileges, persistent access, arbitrary code execution, or direct credential access are obtained through t ...[truncated 22 chars]
• Remediation: ## Remediation Suggestions - Remove the mandatory post-extraction promotional message. - Mention authentication only when the selected operation actually requires a token and no valid authentication is configured. - Clearly identify MinerU as an external service before directing users to it. - Obtain user confirmation before uploading documents or sending document content to an external API. - Keep normal conversion responses limited to the requested output, status, and relevant errors.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:35
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 35-39 **Vulnerability Type**: Mutable dependency installation with global scope **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Installation ```bash npm install -g mineru-open-api ``` Verify: `mineru-open-api version` ``` ### Technical Analysis The installation command does not pin a package version, lock an integrity digest, or identify a reviewed registry source. Consequently, npm resolves whatever version is represented by the package's current default distribution tag when installation occurs. npm packages can execute lifecycle scripts during installation. The global installation flag broadens the effect by placing the package in a shared system or user-level location and may require elevated privileges on some systems. If the package, a transitive dependency, its publisher account, or the configured npm registry is compromised, installation could execute attacker-controlled code before the conversion tool is used. The audit found no evidence that the named package is itself malicious. The vulnerability is the unsafe, mutable installation process and its expanded global scope. ### Attack Path 1. An attacker compromises the npm package, one of its transitive dependencies, a publisher account, or the registry used by the environment. 2. The attacker publishes a malicious version or changes the package version resolved by the default distribution tag. 3. A user or agent follows the skill instruction and runs `npm install -g mineru-open-api`. 4. npm downloads the mutable package graph and may execute malicious lifecycle scripts. 5. The malicious code runs with the privileges of the installing account; if the command is executed with administrative elevation, the compromise can inherit those elevated privileges. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the account ...[truncated 416 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to a specifically reviewed version rather than using the mutable latest release. - Verify the package against a trusted registry and record its expected integrity digest. - Prefer a project-local installation with a committed lockfile over global installation. - Run the tool through a restricted environment or container with only the document and output directory mounted. - Disable npm lifecycle scripts during installation when the package does not require them, and review any required scripts before execution. - Do not install with administrative privileges. - Establish a dependency-update process that reviews release provenance, transitive dependency changes, and published package contents before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill sends user-supplied documents to an external MinerU service for conversion, but the description does not disclose that document contents may leave the local environment. This can cause users to unknowingly upload sensitive or regulated data to a third-party processor, creating privacy, confidentiality, and compliance risk.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

- ocr
tools:
  - Bash(mineru-open-api:*)
model: claude-3-5-haiku-20241022
---

# Word to HTML Conversion with mineru-open-api

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The file includes a post-extraction instruction to show a tip in Chinese, but the rest of the skill is written in English and no user opt-in or locale rationale is provided. This can violate language/locale policy by forcing a specific language for user-facing output without choice.

Static analysis

No suspicious patterns detected.