中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:2 days ago Rescan
15 /100
pptx-ocr
OCR for PowerPoint (.pptx) presentations with scanned or image-embedded slide content
Documentation-only skill wrapping a legitimate open-source CLI tool (MinerU) with no hidden functionality or malicious code.
Skill Namepptx-ocr
Duration28.0s
Enginepi
✓
Safe to install
This skill is safe to use. Ensure MINERU_TOKEN is kept confidential and verify the mineru-open-api package source before installation.

Findings 2 items

Severity Finding Location
Low
External package dependency
Skill instructs users to install mineru-open-api from npm/go. While MinerU is legitimate open-source software, always verify package authenticity.
npm install -g mineru-open-api
→ Verify npm package integrity and source before installation
 SKILL.md:15
Info
API token required
MINERU_TOKEN environment variable required for OCR functionality. This is a standard API authentication pattern.
export MINERU_TOKEN="your-token"
→ Ensure token is stored securely and not logged or exposed
 SKILL.md:31
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ ✓ Aligned SKILL.md: Extracts .pptx files
Network READ READ ✓ Aligned SKILL.md: Supports URL input for extraction
Environment READ READ ✓ Aligned SKILL.md: Uses MINERU_TOKEN for API auth
Shell NONE NONE — No shell commands in SKILL.md
2 findings
🔗
Medium External URL 外部 URL
https://mineru.net
SKILL.md:4
🔗
Medium External URL 外部 URL
https://mineru.net/apiManage/token
SKILL.md:39

File Tree

1 files · 2.6 KB · 55 lines
Markdown 1f · 55L
└─ 📝 SKILL.md Markdown 55L · 2.6 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
mineru-open-api * npm/go No External CLI tool - verify package authenticity

Security Positives

✓ No executable scripts or code present - documentation only
✓ Uses legitimate open-source project (MinerU by OpenDataLab/Shanghai AI Lab)
✓ All capabilities clearly declared in SKILL.md
✓ No credential harvesting beyond required API authentication
✓ No network exfiltration or suspicious data transfer
✓ No hidden HTML comments or obfuscated code