Private Document AI with OpenVINO

• Outcome: Review
• Latest audit: Jul 20, 2026 · 8:15 AM UTC
• Version: 0.4.1

Overview

This skill mostly does what it says, but it needs review because its local server and generated notebooks can create higher-risk behavior than a private document parser implies.

Install only if you are comfortable with a local background document service and plaintext artifact folders. Keep the HTTP host on 127.0.0.1, avoid exposing the service to a network, use a private output directory for sensitive documents, delete artifacts after review, pin or audit dependencies, and do not run generated notebooks until you have removed or approved remote model-loading code such as trust_remote_code=True.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'req' from os.environ.get (line 163, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
        headers["Content-Type"] = "application/json"
    req = urllib.request.Request(url, data=body, headers=headers, method=method)
    with urllib.request.urlopen(req, timeout=timeout_s) as resp:
        text = resp.read().decode("utf-8")
    return json.loads(text) if text.strip() else {"ok": True}

• Confidence: 90% confidence
• Finding: The client builds HTTP_BASE_URL from environment-controlled host and port values and then sends requests to that endpoint with urllib.request.urlopen. If an attacker can influence the environment, they can redirect the client to an unintended server, causing SSRF-like behavior against local or internal services and potentially sending document paths, parse options, or shutdown requests to an attacker-controlled listener.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises and documents capabilities that read local files, write artifacts, inspect environment variables, invoke shell commands, and access network resources, yet it declares no permissions. That mismatch can mislead users and policy engines about the actual trust boundary, especially because installation and model acquisition paths include PowerShell, pip, and git/network use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 78% confidence
• Finding: The public description frames the skill primarily as private document parsing and structured extraction, but the body also exposes a broader code-generation pipeline that can emit HTML, React, JSON Schema, and Jupyter notebooks. This broader behavior materially changes risk because generated code/notebooks may later be executed, published, or connected to systems, while users expecting only extraction may not scrutinize those outputs appropriately.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The service is described as local/private, but the bind host is taken directly from an environment variable and can therefore be changed to 0.0.0.0 or another non-loopback address. That can unintentionally expose document-parsing functionality to other local-network users or hostile local processes, especially because the service has no authentication controls in this file.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The /shutdown endpoint allows any caller that can reach the service to terminate the process, creating an easy denial-of-service condition unrelated to parsing. In the context of a long-lived local helper service, this is especially risky because the same unauthenticated interface is intended to be called by other tools and could be abused by untrusted local software or, if remotely exposed, by network attackers.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This script’s stated purpose is transforming parsed document JSON into code artifacts, but it also generates an executable Jupyter notebook that loads Hugging Face models, exports them to OpenVINO, and scaffolds an interactive demo. That creates an unjustified execution path from document-processing input to AI/ML code generation, increasing the chance that users will run powerful generated code they did not expect or adequately review.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The generated notebook contains code that acquires remote models via from_pretrained(..., trust_remote_code=True), performs model export/compilation, and includes Gradio demo scaffolding. This is dangerous because generated artifacts may be treated as trustworthy outputs of a document-conversion tool, yet running them can execute untrusted upstream model code and trigger network access and local service exposure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code writes extracted table content from parsed documents to per-table CSV files and a combined tables.csv on local disk. Because this skill processes invoices, medical receipts, contact details, and tax identifiers, these exports can persist sensitive data in plaintext without any consent gate, retention control, or minimization, increasing exposure through other local users, backups, or later exfiltration.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script generates local HTML reports that embed or display source document paths, rendered source pages, extracted full text, structured records, and raw JSON outputs. In a document-processing skill focused on invoices, PDFs, screenshots, and similar artifacts, those outputs are likely to contain sensitive personal, financial, or business data; saving them into browsable HTML files increases the chance of unintended local disclosure, sharing, indexing, or later exfiltration by other software or users on the same system.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script persists multiple artifacts derived from potentially sensitive document contents, including normalized records, extracted fields, entities, key-value pairs, and traceability data, to disk under a user-specified output directory. In the context of private local document AI handling invoices, PDFs, and screenshots, this can expose confidential data at rest if users are unaware of the persistence behavior, especially on shared systems or when output directories are synced, backed up, or broadly readable.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openvino-genai>=2026.1.0,<2027
mineru-vl-utils>=0.2.7
pypdfium2
Pillow

# Local service layer for the default app-like experience.

• Confidence: 95% confidence
• Finding: `pypdfium2` is included without any version constraint, so installs may pull different releases over time, including releases with security defects or breaking changes. In a document-processing skill that handles PDFs from users, dependency drift increases supply-chain risk and can expose the service to parser bugs triggered by malicious files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openvino-genai>=2026.1.0,<2027
mineru-vl-utils>=0.2.7
pypdfium2
Pillow

# Local service layer for the default app-like experience.
fastapi>=0.115,<1

• Confidence: 99% confidence
• Finding: `Pillow` is completely unpinned, which is particularly risky because it is an image parser frequently exposed to untrusted input and has a history of security issues. In this skill's context—processing screenshots, invoices, and diagrams—an unsafe or newly introduced Pillow release could be directly reachable by attacker-supplied files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# snake7gun/MinerU2.5-Pro-2604-1.2B-int4-ov

openvino-genai>=2026.1.0,<2027
mineru-vl-utils>=0.2.7
pypdfium2
Pillow

• Confidence: 88% confidence
• Finding: `mineru-vl-utils>=0.2.7` has only a lower bound and no upper bound, so future installs may resolve to unreviewed versions with changed behavior or newly introduced vulnerabilities. Because this package is part of the core document AI pipeline, compromised or unsafe updates could affect parsing, model orchestration, or file handling.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: Using `Pillow` without a fixed patched version leaves the environment exposed to known Pillow advisories if dependency resolution selects a vulnerable release. This is more dangerous in this skill because it explicitly processes user-provided images and document renderings, making image-decoder flaws such as denial of service or potential code-execution bugs directly relevant.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.