mineru-api
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill reads local files and sends them to the MinerU Cloud API at mineru.net for document parsing. This is the core intended behavior of the skill as a cloud-based document extraction service.
- [COMMAND_EXECUTION]: The skill includes Python scripts that perform local file system operations (reading documents, writing results) and network communication. These scripts process user-provided paths and URLs through standard libraries without invoking shell interpreters or executing arbitrary code.
- [PROMPT_INJECTION]: Since the skill ingests and parses content from external files and URLs, it possesses a surface for indirect prompt injection. Maliciously crafted documents could contain instructions designed to influence the agent's behavior once the parsed content is returned to the context. This is an inherent risk for document parsing tools, and the skill does not implement specific boundary markers to mitigate this risk.
- [EXTERNAL_DOWNLOADS]: The skill downloads processed results in ZIP format from the MinerU API's CDN. These downloads are part of the standard workflow of the document parsing service and originate from the service's official infrastructure.
Audit Metadata