Smart PDF OCR

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  0.2.0

Overview

This is a focused PDF OCR helper that uses the disclosed MinerU CLI/API, with no hidden code, persistence, or unrelated authority found.

Install only if you trust the mineru-open-api package and MinerU service. Avoid using it on confidential, regulated, identity, medical, legal, or financial documents unless you are comfortable with those documents being processed by that provider. Consider confirming before running OCR when a request is vague, such as simply asking to read a scanned document.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill advertises broad natural-language triggers such as 'how to OCR a PDF file', 'can you read this scanned document', and 'digitize my PDF', which are common everyday phrases that may match user requests loosely and cause the skill to activate unexpectedly. Because the skill can invoke a Bash tool and process user-supplied files, ambiguous activation increases the chance of unintended external tool execution and document handling without sufficiently explicit user intent.

VirusTotal

66/66 vendors flagged this skill as clean.