professional-pdf-translator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:12 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent local PDF-to-Chinese DOCX translation workflow with disclosed file reads and writes, but users should handle untrusted PDFs and custom regex highlights carefully.

Install only if you are comfortable with a workflow that reads local PDFs and glossary files, writes or appends to a DOCX, and maintains a dynamic glossary file. Use a new output DOCX path, review generated glossary terms before reuse, avoid processing hostile PDFs in a tool-rich agent session, and do not pass untrusted custom regex highlight rules.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:109

Finding

Indirect Prompt Injection Through Untrusted PDF and Glossary Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 109-114
Vulnerability Type: Indirect prompt injection caused by unsafe handling of untrusted document content
Risk Level: Medium

Relevant Skill Instruction:

markdown

### Step 2: Perform LLM Translation

- **Image-only page** (`is_empty: true`): Skip translation and write `Page {page_num}: Image-only page`
- **Page with text**: Submit the source `text`, matching `matched_terms`, current dedicated glossary, and user-provided translation style instructions to the model for translation.

Technical Analysis

The workflow directs the agent to submit text extracted from arbitrary PDF files and glossary entries directly to the language model. It does not establish a trust boundary around that content or explicitly instruct the model to treat instructions contained in the source material as inert data.

PDF text and glossary files are attacker-controllable inputs. A malicious document can include statements formatted as model instructions, such as directions to ignore the translation task, reveal contextual data, alter output, invoke available tools, or generate attacker-selected glossary entries. Because the document content is inserted into the same model context used to perform the task, the model may interpret those statements as executable instructions rather than material to translate.

The dynamic glossary increases the potential persistence within the current translation job: model-generated terms are appended to a file and reused as context on later pages. A successful injection could therefore influence subsequent translation steps by causing malicious or misleading content to be stored in that glossary.

Attack Path

1. An attacker creates or modifies a PDF or glossary containing instruction-like text.
2. The user processes that file using the Skill.
3. scripts/extract_page.py extracts the malicious text or returns the malicious glossar ...[truncated 1421 chars]

Remediation

View remediation

Remediation Suggestions

1. Add an explicit instruction before every model call stating that PDF text and glossary entries are untrusted data and that any commands found inside them must not be followed.
2. Place source text and glossary data in clearly delimited data blocks, separate from system and workflow instructions.
3. Require the model to perform only translation and structured term extraction during this step.
4. Disable unrelated tools while translating untrusted document content, or enforce a strict tool allowlist.
5. Validate generated glossary entries before writing them. Reject entries containing instruction-like phrases, markup intended to alter prompts, excessive length, or malformed term mappings.
6. Do not submit the complete dynamic glossary when only matched entries are needed.
7. Require user confirmation before persisting newly generated terms when processing documents from untrusted sources.
8. Consider using a separate, tool-free model invocation for document translation so document text cannot influence a tool-enabled agent session.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/append_docx.py:35

Finding

Regular Expression Denial of Service Through User-Controlled Highlight Rules

Content

View full analysis

Vulnerability Details

File Location: scripts/append_docx.py, lines 35-44 and 64-72
Vulnerability Type: Regular Expression Denial of Service
Risk Level: Medium

Vulnerable Code:

python

parts = arg.rsplit(':', 1)
if len(parts) != 2:
    continue
pattern_str, color_str = parts
try:
    color_str = color_str.strip().lstrip('#')
    r = int(color_str[0:2], 16)
    g = int(color_str[2:4], 16)
    b = int(color_str[4:6], 16)
    compiled = re.compile(pattern_str.strip())
    result.append((compiled, RGBColor(r, g, b)))
except (ValueError, re.error):
    continue

python

if not highlights:
    pattern_str = r'(\*\*.*?\*\*)|(\*.*?\*)'
else:
    hl_patterns = [h[0].pattern for h in highlights]
    parts = [r'\*\*.*?\*\*', r'\*.*?\*'] + hl_patterns
    pattern_str = '|'.join(f'({p})' for p in parts)

compiled = re.compile(pattern_str)
tokens = compiled.split(text)

Technical Analysis

The --highlights command-line option accepts arbitrary regular expressions. These expressions are compiled and combined with the Markdown formatting patterns, then evaluated against the complete translated text using Python's standard re engine.

Python's backtracking regular-expression implementation does not provide an execution timeout in this usage. Patterns containing nested or ambiguous quantifiers can exhibit catastrophic backtracking. For example, a pattern structurally similar to (a+)+$ can require exponentially increasing processing time when evaluated against a long sequence of matching characters followed by a non-matching character.

Syntax validation through re.compile() only confirms that a pattern is grammatically valid. It does not detect computationally dangerous expressions. The code also imposes no limit on pattern length, number of patterns, input text size, or matching time.

Attack Path

1. An attacker controls or influences a custom highlight rule su ...[truncated 1215 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not accept unrestricted regular expressions when simpler literal or wildcard matching satisfies the feature requirements.
2. Prefer a safe allowlist of supported pattern forms.
3. Reject nested quantifiers, ambiguous alternation, backreferences, lookarounds, and other constructs likely to produce excessive backtracking.
4. Enforce strict maximum lengths for each pattern, the number of highlight rules, and the input text processed in one operation.
5. Use a regular-expression engine that guarantees linear-time matching or supports enforceable timeouts.
6. If Python's standard re engine must be retained, evaluate user patterns in an isolated worker process with CPU and wall-clock limits, terminating the worker when limits are exceeded.
7. Return an explicit validation error when a rule is rejected rather than silently skipping malformed or unsafe rules.
8. Add regression tests using known pathological patterns and long adversarial input strings.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述的是一个端到端 PDF 翻译工作流，核心能力应包括：读取 PDF、多页逐页处理、结合用户术语表、执行翻译、输出 DOCX。所给代码块却只是该流程中很小的一部分后处理脚本：它读取一个现成的文本文件，将其中的 Markdown 内容追加到 DOCX，按页插入分隔标题，并支持粗体/斜体/自定义正则高亮。代码没有任何 PDF 解析、页面提取、术语表加载/匹配或翻译逻辑，因此其主要功能与声明的主要目的存在实质差异。虽然“追加至 DOCX”与总描述部分重合，但不足以覆盖被声明的核心工作流能力，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a full PDF translation automation workflow: extracting text from long PDFs, matching terms from a local glossary, translating content, and appending results to a DOCX. The supplied code does none of those core tasks. It only accepts a file path and a list of terms, ensures the target file exists, optionally inserts a newline, and appends the terms to that file using UTF-8 encoding. While glossary maintenance could be a supporting component of a larger translator system, this code chunk by itself is materially different in primary purpose and implemented capabilities from the declared description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill instructs the agent to read user-supplied local files and create/append output files, but it does not declare any explicit tool scope such as allowed-tools or permissions. That weakens user and platform visibility into what file operations the skill may perform and increases the risk of unintended access or modification of local data when the workflow is executed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill repeatedly instructs the agent to create, append, and modify local files such as DOCX outputs, temporary text files, and a dynamic glossary, but it does not prominently warn about those write operations or possible overwrites/appends. In a workflow that processes user-supplied paths, this can lead to accidental corruption of existing documents or silent modification of files the user did not expect to be changed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions explicitly require the model to produce 'only pure Chinese translation,' which forces a specific output language. Under the policy, locale or language constraints should either be optional for the user or clearly justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language interface text exclusively in Chinese, including the module description and usage instructions. That imposes a language choice on users without offering an alternative or opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The argparse description and help strings are all written in Chinese, so users interacting with the command-line interface are required to use that language. Because there is no language choice or documented locale-specific justification in the file, this is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.