Mineru Pdf

Parse PDF documents with MinerU MCP to extract text, tables, and formulas. Supports multiple backends including MLX-accelerated inference on Apple Silicon.

This skill appears to do what it says: parse PDFs via MinerU MCP or the included Python wrapper. Before installing or running it: (1) ensure you trust the uvx/mcp-mineru package source and be aware that model downloads may occur on first use; (2) run parse.py with an explicit output_dir to avoid accidental writes to sensitive locations; (3) do not run test.sh without inspecting or replacing its default PDF path (it points to an inbound media file under ~/.openclaw); and (4) if you need stronger isolation, run the tool in a sandbox or VM since it will create persistent files and may download model artifacts.

Type: OpenClaw Skill Name: mineru-pdf Version: 1.0.0 The skill is classified as suspicious due to a shell injection vulnerability found in the `test.sh` script. The script directly interpolates the `$PDF_FILE` variable into a Python string executed by `uvx`, which could allow an attacker to inject arbitrary commands if the `PDF_FILE` variable contains malicious characters. While `parse.py` uses `argparse` for robust input handling, the `test.sh` script demonstrates a critical RCE risk pattern. No evidence of intentional malicious behavior (e.g., data exfiltration, persistence, or prompt injection against the agent) was found in other files like `SKILL.md` or `parse.py`.