本地模型PDF翻译（Windows）

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:32 AM UTC
• Version: 2.0.4

Overview

This is a coherent local document-translation skill, with a privacy caveat if users configure a non-local API endpoint.

Install only if you intend to run a local llama.cpp-compatible translation server. Keep the API URL on localhost for private documents, and do not point it at a remote service unless you trust that service with the full document text and configured bearer key. Use a virtual environment and consider pinning dependency versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/translate_api.py:29

Finding

Unrestricted API Endpoint Can Disclose Document Content and Bearer Credentials over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:69

Finding

Runtime Dependencies Are Installed without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

\ --hash=sha256: requests== \ --hash=sha256: ``` 2. Install dependencies with integrity enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Record hashes for every supported Python version, platform, and wheel artifact. 4. Periodically update pinned versions through a reviewed dependency-update process. 5. Run vulnerability and provenance checks before accepting dependency updates. 6. Recommend installation in a dedicated virtual environment rather than a global or administrator-level Python environment. 7. Keep the requirement to obtain explicit user consent before an Agent performs package installation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a full PDF translation skill powered by a local llama.cpp model, with multilingual translation, page-by-page translation, and Markdown output. The supplied code chunk does not translate anything at all. It only extracts existing PDF text, retrieves basic metadata, and checks whether the PDF likely contains extractable text. While PDF extraction could be a supporting component of a translation pipeline, this code chunk by itself materially differs from the declared primary purpose and lacks the core advertised capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description emphasizes a Windows tool for batch PDF translation using a local llama.cpp model, with page-wise extraction and .md output. The supplied code chunk only provides a generic translation API wrapper and CLI for translating raw text from stdin, a text argument, or a text file. It constructs prompts reflecting the three-step translation style and supports arbitrary language directions, which partially aligns with the translation aspect. However, the core advertised capabilities—PDF handling, page extraction, batch document processing, markdown output, and direct local llama.cpp model usage—are absent from this code. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/translate_api.py (reported line 138)May include surrounding context.

python

if context:
            prompt += f"Context:\n{context[:500]}\n\n---\n\n"
        prompt += f"Translate the following into {tgt_name}:\n\n{text}"
        return prompt
    
    def translate_segment(self, text: str, direction: str = "en2zh",
                         depth: str = "standard", context: str = "") -> Dict:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documentation advertises capabilities that imply file access, environment-variable use, and HTTP communication, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, that omission weakens least-privilege enforcement and can let an agent operate with broader-than-expected access when handling untrusted PDFs, local files, and API settings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The direction field is fixed to en2zh, which imposes a specific language conversion policy. Under the stated rule, forcing a language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code hard-codes English for language-name display via get_language_name(..., "en"), and the CLI/user-facing output strings are also fixed in English. This imposes a specific language/locale on users without offering a choice, which matches the policy category for language or locale violations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The generated markdown for translated text uses fixed English headings such as "Translation", "Source", "Direction", and "Generated". Because no locale choice is provided, the skill enforces English in produced artifacts, which is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The PDF output writer again forces English language names and English metadata labels in generated files. This repeated English-only behavior affects all output artifacts and is not presented as an opt-in or region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code sends extracted PDF text chunks to translator.translate_segment(...), which implies transmitting document contents to a translation service. Although the script prints progress and its purpose is translation, there is no clear user-facing warning in this file that document data may leave the local system or be processed by an API.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file contains user/developer-facing natural-language text in Chinese only, beginning with the module description. Under the policy, forcing a specific language without opt-in can be a locale/language policy violation when no alternative or user choice is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The program sends extracted document text to a translation API through LocalTranslator without any explicit privacy notice, consent flow, or sensitivity check. Even if the configured endpoint is local by default, the code accepts arbitrary api_url configuration, so users may unknowingly transmit sensitive document contents to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Markdown and text files are read in full and sent to the translation API with no user-facing warning that file contents leave the process boundary. In this skill context, users may translate notes, drafts, or confidential text, so silent transmission increases the risk of accidental data exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file advertises a local llama.cpp-based translator, but the implementation sends document text to a configurable HTTP API endpoint. This mismatch can cause users to expose sensitive PDF contents under the false assumption that processing stays entirely local, creating a privacy and trust-boundary violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The connection check performs network communication despite the skill being described as local PDF translation with a local model. In this context, undocumented network use weakens user expectations about isolation and may lead to sensitive academic or proprietary material being sent to a service outside the user's intended trust boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The requests.post call transmits the full prompt payload, including source text and optional context, to the configured API endpoint. External transmission is security-relevant here because the skill's purpose is document translation, so the payload may include entire pages of sensitive PDF contents and prompt metadata.

Content

Scanner excerpt · scripts/translate_api.py (reported line 81)May include surrounding context.

python

payload["model"] = self.model
        
        try:
            resp = requests.post(
                self.api_url,
                headers=self.headers,
                json=payload,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code sends user-supplied text and context to an API without any explicit warning, consent prompt, or redaction step. Because this skill processes PDFs that may contain confidential research, personal data, or unpublished manuscripts, silent transmission materially increases the risk of unintended data disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill documentation begins entirely in Chinese and presents the skill description in that language without indicating that users can choose another language for instructions. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is specifically scoped to PDF translation with per-page extraction, yet the file discovery logic includes Markdown and plain text files, and later translates them directly. This expands behavior beyond the stated document type in a way not described by the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The calls get_language_name(src, "en") and get_language_name(tgt, "en") force English for user-visible language labels. This imposes a specific locale choice without offering the user a language preference or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This Python file contains its module description, comments, and several user-facing help/output strings primarily in Chinese, and get_language_name defaults its display language to zh. Under the policy rule, forcing a specific language without user opt-in can be a natural-language locale violation when no alternative or choice is offered.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The code calls get_language_name(..., "en"), hard-coding English for displayed language names. This is a natural-language policy concern because the script imposes a specific locale in user-facing output without any opt-in or configuration option.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest scopes the skill as a PDF translation tool with page-by-page extraction and translation, but file discovery explicitly includes .md and .txt inputs in addition to PDFs. This broadens the actual behavior beyond the stated document type, even though it is related to translation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

For generated translation files, the script uses get_language_name(tgt, "en") and writes English-language headings regardless of user preference. This forces a specific language/locale in user-visible output without offering a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The _write_output method hard-codes "en" when rendering source and target language names, producing English-only metadata in output files. This is a locale policy issue because users are not given a way to select or opt into the display language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.