中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:2 days ago Rescan
5 /100
doc-to-markdown
Convert Word documents (.doc/.docx) to clean Markdown using MinerU's document processing engine
The skill is a thin documentation wrapper for the legitimate mineru-open-api CLI tool. No implementation code exists beyond SKILL.md; all declared capabilities match actual usage patterns.
Skill Namedoc-to-markdown
Duration32.9s
Enginepi
✓
Safe to install
Skill is safe to use. No code review needed beyond the external binary.

Findings 3 items

Severity Finding Location
Low
npm install without version pinning
SKILL.md shows 'npm install -g mineru-open-api' without pinning to a specific version. Future malicious versions could be installed.
npm install -g mineru-open-api
→ Pin to a specific version: npm install -g [email protected]
 SKILL.md:12
Low
No code audit trail for external binary
The skill delegates all document processing to the external mineru-open-api binary. Any vulnerabilities in that binary are not visible in this skill package.
Built on MinerU by OpenDataLab (Shanghai AI Lab)
→ Users should verify the integrity of mineru-open-api from its official GitHub (github.com/opendatalab/MinerU-Ecosystem) before installation
 SKILL.md:1
Info
API token sent to external service
MINERU_TOKEN is sent to mineru.net when extracting .doc files. This is declared and necessary for the service.
export MINERU_TOKEN="your-token"
→ Ensure MINERU_TOKEN has minimal scope/permissions. No evidence of exfiltration.
 SKILL.md:43
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ ✓ Aligned SKILL.md: reads .doc/.docx input files
Filesystem WRITE WRITE ✓ Aligned SKILL.md: '-o ./out/' writes .md output
Network READ READ ✓ Aligned SKILL.md: 'supports local files and URLs'; API calls to mineru.net for .doc extr…
Shell WRITE WRITE ✓ Aligned SKILL.md: npm/golang install commands; CLI invocations
Environment READ READ ✓ Aligned SKILL.md: reads MINERU_TOKEN env var for authenticated .doc extraction
Skill Invoke NONE NONE — No nested skill invocation declared or observed
2 findings
🔗
Medium External URL 外部 URL
https://mineru.net
SKILL.md:4
🔗
Medium External URL 外部 URL
https://mineru.net/apiManage/token
SKILL.md:45

File Tree

1 files · 3.3 KB · 60 lines
Markdown 1f · 60L
└─ 📝 SKILL.md Markdown 60L · 3.3 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
mineru-open-api * npm/go No Version not pinned in SKILL.md; binary executed at runtime

Security Positives

✓ No implementation scripts or code - skill is purely documentation
✓ All declared capabilities (filesystem, network, shell, env) match documented usage
✓ No credential harvesting beyond the service token required for the feature
✓ No base64, eval, curl|bash, or other high-risk patterns detected
✓ No sensitive path access (~/.ssh, ~/.aws, .env) or data exfiltration
✓ Uses standard package managers (npm, go) with official sources
✓ No hidden functionality - SKILL.md fully describes the tool's behavior
✓ Open-source tool (MinerU) with community visibility