本地模型PDF翻译（Ubuntu/Linux）

• Outcome: Pass
• Latest audit: Sep 5, 2026 · 3:03 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed local-document translation helper; its main privacy caveat is that user-configured remote API endpoints would receive document text.

Install only if you are comfortable with the tool reading the documents you point it at and sending their text to the configured translation endpoint. Keep api_url on localhost for private material, change the default API key if local exposure matters, and approve any dependency/model installation only after reviewing the exact commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly instructs use of environment variables, local file reads/writes, and network access to a localhost API, yet no explicit permissions are declared. This creates a transparency and policy-enforcement gap: an agent or platform may execute file and network operations the user did not expect, especially because the workflow also supports writing translated outputs and optionally downloading/installing dependencies.

Description-Behavior Mismatch

Low

• Confidence: 90% confidence
• Finding: The skill is presented as local-only, but the documentation explicitly allows overriding `api_url` to a remote endpoint, which could cause sensitive document contents to be transmitted off-host. This is dangerous because users may rely on the local-processing claim for privacy and may not appreciate that a configuration change alters the trust boundary and exposes document data to third parties.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill is presented as local-only, but the documentation explicitly allows overriding `api_url` to a remote endpoint, which could cause sensitive document contents to be transmitted off-host. This is dangerous because users may rely on the local-processing claim for privacy and may not appreciate that a configuration change alters the trust boundary and exposes document data to third parties.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill is marketed as a local llama.cpp-based translator, but this module is implemented as a generic HTTP client that sends content to a configurable API endpoint with bearer-token authentication. That mismatch creates a real security and privacy risk because users may reasonably assume documents stay local while sensitive PDF text can be transmitted off-host if the endpoint is remote or reconfigured.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script reads entire Markdown/text documents and forwards their contents to a translator backend without any explicit notice, consent flow, or locality guarantee. If the configured API endpoint is remote or misconfigured, sensitive document contents could be unintentionally disclosed to an external service.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: PDF text extracted from potentially sensitive documents is sent to the translation backend page-by-page/chunk-by-chunk with no explicit disclosure or enforcement that processing remains local. In a document-translation skill, this increases privacy risk because users may reasonably assume their PDFs are processed entirely on-device.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script extracts full PDF text and passes it to `translator.translate_segment(...)`, which transmits document content to a translation service endpoint configured by `api_url`. Even if the endpoint is described as local, it may actually be remote or proxied, and the code provides no explicit consent prompt, warning, or data-handling notice before sending potentially sensitive PDF contents off-process.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code sends the input text and optional context to an API without any explicit warning, consent flow, or destination disclosure. In a PDF translation skill, inputs may contain unpublished research, personal data, or confidential documents, so silent transmission materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script embeds a predictable default API key (`llama2025`) that will be used whenever the operator does not explicitly set `API_KEY`. Although the server binds to `127.0.0.1`, local-only exposure does not eliminate risk: other local users, compromised processes, containers sharing the host namespace, or users forwarding the port could authenticate trivially with the known default.

External Transmission

Medium

• Category: Data Exfiltration

Content

payload["model"] = self.model
        
        try:
            resp = requests.post(
                self.api_url,
                headers=self.headers,
                json=payload,

• Confidence: 92% confidence
• Finding: This request performs external transmission of user-supplied text, context, and system prompts to whatever endpoint is configured in api_url. The behavior is not inherently malicious, but in this skill context it is security-relevant because the input is extracted from PDFs and may contain sensitive information that leaves the local environment.

Static analysis

No suspicious patterns detected.