The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script contains logic to read sensitive credentials from outside the skill's directory. Specifically, the readOfficialCliToken function in scripts/convert.js attempts to read and parse ~/.mineru/config.yaml to retrieve an API token if one is not provided in the skill's environment configuration.
[COMMAND_EXECUTION]: The scripts/convert.js script makes extensive use of the $.system function to execute shell commands (including curl, cp, mv, unzip, find, stat, and mdls). While it attempts to use a shellQuote function to sanitize inputs, the large surface area of shell interaction increases the risk of command injection if sanitization is bypassed.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from untrusted sources. In scripts/convert.js, the downloadRemoteImages function uses curl to download images from any URL found within the OCR-generated Markdown. This could be used for server-side request forgery (SSRF) or to download malicious assets.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted data from local files and remote URLs, processes them into Markdown, and returns the result to the agent.
Ingestion points: scripts/convert.js reads local files and remote document/HTML URLs.
Boundary markers: The script does not wrap the converted content in protective delimiters or provide instructions to the agent to ignore embedded commands.
Capability inventory: The skill has access to file system operations (read/write/delete) and network operations via shell commands in scripts/convert.js.
Sanitization: There is no sanitization of the document content before it is passed back to the agent, allowing a malicious document to potentially hijack the agent's instructions.

mineru-ocr