本地模型PDF翻译（Windows）

• Outcome: Pass
• Latest audit: Sep 5, 2026 · 3:03 AM UTC
• Version: 2.0.4

Overview

This skill translates user-selected documents through a configured llama.cpp-compatible endpoint and writes Markdown outputs, with the main privacy risk being whether the configured API endpoint is truly local and trusted.

Use this skill only with a llama-server endpoint you control and trust. For confidential PDFs, keep api_url at the localhost default, confirm the server is bound to 127.0.0.1, and avoid configuring a remote API unless you intend to send document text there.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation describes capabilities to read PDFs, write translated Markdown outputs, access environment variables, and make HTTP requests to a local API, yet no explicit permission model is declared. This creates a transparency and consent gap: an agent or platform may execute file and network operations the user did not expect, especially when processing sensitive local documents.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The manifest claims a local llama.cpp workflow, but the script relies on an API-style translator endpoint and performs a connection check before processing. That mismatch can mislead users into believing documents stay fully local when content may instead be sent to a network-accessible service, creating confidentiality risk for sensitive PDFs or text files.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module is presented as using a local llama.cpp model, but it is implemented as an HTTP client that loads an API key and sends requests to a configured endpoint. That mismatch can mislead users into treating sensitive PDF contents as local-only processing when the code may transmit them to another service.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The skill states the API endpoint and local server usage, but it does not clearly warn that extracted PDF text is transmitted over HTTP to the local translation API for every translation request. Even though the endpoint is localhost, this is still a data-flow disclosure issue because users may assume processing is entirely in-process and may submit confidential PDFs without realizing their contents are being sent to another service.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The translator is configured to send document contents to an API/model endpoint, and the script provides no explicit user-facing disclosure or consent flow before processing potentially sensitive local documents. In this skill's context, users may assume 'local model' means no content leaves the machine, so silent transmission to a configured endpoint increases confidentiality risk if the endpoint is remote, proxied, logged, or misconfigured.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code sends extracted PDF text to a translation backend via `translator.translate_segment(...)` without any explicit consent prompt, warning, or clear disclosure at the point of use. Even if the backend is described as local, the URL is configurable and may point to a remote service, so sensitive document contents could be transmitted outside the user's trust boundary unintentionally.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script sends full document content to translate_segment without any explicit user-facing warning, consent step, or destination transparency. In a translation skill handling PDFs and text, this is dangerous because users may process confidential research, legal, or personal documents under the assumption that translation is local, leading to unintended data disclosure to a service endpoint.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code sends user-supplied text and optional context to `self.api_url` in the JSON payload without any user-facing notice or consent prompt. In a PDF translation skill, the input is likely to contain sensitive academic, business, or personal content, so silent transmission creates a privacy and data-handling risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

payload["model"] = self.model
        
        try:
            resp = requests.post(
                self.api_url,
                headers=self.headers,
                json=payload,

• Confidence: 94% confidence
• Finding: `requests.post(...)` transmits the translation payload, including user text and constructed prompts, to an external endpoint. In the context of document translation, this is security-relevant because it can exfiltrate proprietary or personal document contents if the endpoint is remote, compromised, or misconfigured.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.