mineru-ocr
Fail
Audited by Snyk on Feb 20, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to accept user API tokens (e.g., "帮我配置 MinerU，Token 是：
xxx" and "新的 Token 是：xxx") and to insert them into configuration files or commands, which requires echoing secrets verbatim in output and thus creates exfiltration risk.
Audit Metadata