中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：2 天前 重新扫描
5 /100
extract-formulas-from-pdf
Extract mathematical formulas and equations from PDF documents using MinerU
This is a straightforward skill wrapping the legitimate MinerU open-source PDF formula extraction tool. All capabilities, dependencies, and authentication requirements are clearly declared in SKILL.md with no hidden functionality.
技能名称extract-formulas-from-pdf
分析耗时21.5s
引擎pi
✓
可以安装
This skill is safe to use. The only requirements are a valid MINERU_TOKEN for API authentication, which is standard for cloud-based document intelligence services.

安全发现 2 项

严重性 安全发现 位置
提示
External API dependencies
The skill depends on external mineru.net API service for formula extraction. This is declared and necessary for the core functionality.
homepage: https://mineru.net
→ No action needed - this is expected behavior for cloud-based services
 SKILL.md:4
提示
API token requirement
Requires MINERU_TOKEN environment variable for authentication. This is standard practice for API-based services.
export MINERU_TOKEN="your-token"
→ No action needed - token-based auth is documented and expected
 SKILL.md:40
资源类型声明权限推断权限状态证据
网络访问 READ READ ✓ 一致 SKILL.md uses mineru-open-api CLI which calls mineru.net API
文件系统 READ READ ✓ 一致 SKILL.md reads PDF files as input, writes to -o output directory
环境变量 READ READ ✓ 一致 SKILL.md requires MINERU_TOKEN environment variable
命令执行 WRITE WRITE ✓ 一致 SKILL.md documents npm install and go install commands
2 项发现
🔗
中危 外部 URL 外部 URL
https://mineru.net
SKILL.md:4
🔗
中危 外部 URL 外部 URL
https://mineru.net/apiManage/token
SKILL.md:39

目录结构

1 文件 · 2.9 KB · 55 行
Markdown 1f · 55L
└─ 📝 SKILL.md Markdown 55L · 2.9 KB

安全亮点

✓ All functionality clearly documented in SKILL.md
✓ No shell execution beyond documented CLI tool installation
✓ No credential harvesting beyond required API token
✓ No base64, eval, or obfuscated code patterns
✓ No hidden instructions in comments or documentation
✓ Legitimate open-source project (MinerU by OpenDataLab/Shanghai AI Lab)
✓ No sensitive file access (no ~/.ssh, ~/.aws, .env probing)
✓ No network exfiltration or suspicious external communications