Arxiv Translate Email

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:05 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent paper-translation purpose, but it exposes fixed credentials and can email arbitrary local attachments with weak user controls.

Review before installing. Use only if you trust the publisher and environment, rotate/remove the embedded credentials, constrain attachments to generated translation outputs, validate recipients, and avoid detached cron/nohup operation unless you have clear job tracking and cancellation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:44

Finding

Hardcoded DeepSeek API Key and QQ SMTP Credentials

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_email.py:24

Finding

Arbitrary Local File Disclosure Through Unrestricted Email Attachment Path

Content

View full analysis

[attachment_name]') sys.exit(1) to_email = sys.argv[1] subject = sys.argv[2] body = sys.argv[3] pdf_path = sys.argv[4] attachment_name = sys.argv[5] if len(sys.argv) > 5 else None send_email(to_email, subject, body, pdf_path, attachment_name) ``` ### Technical Analysis The script accepts the recipient address and attachment path directly from command-line arguments. It only checks whether the supplied path exists. It does not verify that: - The path is inside the expected translation output directory. - The target is a regular, non-symlink file. - The file is an actual PDF. - The file was generated by the translation workflow. - The recipient is authorized to receive the file. The supplied file is read completely and attached to an outbound email. Assigning the MIME type `application/pdf` does not validate or transform its contents. Consequently, any file readable by the script's operating-system account can be transmitted while being labeled as a PDF. The vulnerability becomes directly e ...[truncated 1767 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill documentation exposes hardcoded secrets and operational behaviors that go beyond a narrowly scoped arXiv translation helper, including arbitrary SMTP email sending with fixed credentials and attachment delivery. This creates a real capability mismatch: a user-invoked skill framed as document translation can be repurposed to exfiltrate local files or send unauthorized outbound email, while also embedding credentials directly in the skill file.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The command rm -f translated/{slug}.*.pdf performs wildcard deletion using a variable that may be derived from paper metadata or other input, creating a path-manipulation and overbroad deletion risk if slug is malformed or attacker-controlled. Even if intended only for cleanup, insufficient sanitization could delete unrelated files in the translated directory or behave unpredictably with shell metacharacters.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

bash

cd /root/workspace/pdf2zh2 && \
# 清理旧输出
rm -f translated/{slug}.*.pdf && \
HTTPS_PROXY=http://127.0.0.1:7890 HTTP_PROXY=http://127.0.0.1:7890 \
nohup env PYTHONUNBUFFERED=1 \
setsid .venv/bin/python -u .venv/bin/pdf2zh_next \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough to overlap with ordinary user language, increasing the chance the skill activates when the user did not intend to initiate downloading, translation, background processing, or email sending. In a skill that can perform outbound network actions and send mail, accidental activation materially increases security and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill performs consequential actions including sending email, background execution, file cleanup, and network access, yet the documentation does not present explicit risk disclosures or user-consent checkpoints. This makes it easier for users to trigger actions affecting local files, external services, and recipients without understanding the side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L003 的描述直接规定“翻译为中文”，并在后文命令模板中固定为 --lang-out zh，文档中没有说明可由用户选择目标语言或需用户主动确认中文输出。按语言/地区政策要求，强制单一语言输出而无用户选择属于自然语言策略风险。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest says this skill is for downloading arXiv papers, translating them to Chinese, and emailing them. However, the documented interface exposes generic queue administration operations such as listing, counting pending jobs, and clearing completed items, which are operational management capabilities not justified by the user-facing purpose described in the manifest.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

Using nohup causes the translation process to persist after the initiating session ends, which can bypass normal user visibility and control over long-running activity. In combination with network access, credentialed API usage, and email delivery, detached execution increases the risk of unnoticed resource consumption or unauthorized continued processing.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

# 清理旧输出
rm -f translated/{slug}.*.pdf && \
HTTPS_PROXY=http://127.0.0.1:7890 HTTP_PROXY=http://127.0.0.1:7890 \
nohup env PYTHONUNBUFFERED=1 \
setsid .venv/bin/python -u .venv/bin/pdf2zh_next \
  --deepseek \
  --deepseek-api-key "sk-aea81697cdc34baa8a11727b52bbb513" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

Using setsid further detaches the process from the controlling terminal and session, making it harder to monitor or terminate through normal interaction. This strengthens persistence of a task that can consume CPU, access external APIs, and generate/send outputs without the user's active oversight.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

rm -f translated/{slug}.*.pdf && \
HTTPS_PROXY=http://127.0.0.1:7890 HTTP_PROXY=http://127.0.0.1:7890 \
nohup env PYTHONUNBUFFERED=1 \
setsid .venv/bin/python -u .venv/bin/pdf2zh_next \
  --deepseek \
  --deepseek-api-key "sk-aea81697cdc34baa8a11727b52bbb513" \
  --deepseek-model deepseek-chat \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest frames the skill as a paper-processing tool for end users, but the file documents manually spawning an internal worker session. Launching internal workers is an orchestration/operations capability rather than a necessary end-user feature for downloading, translating, and emailing a paper.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script sends arbitrary user-supplied email content and an optional local file attachment directly to an external recipient with no confirmation, authorization check, recipient validation, or audit guardrails. In the context of an agent skill, this creates a strong exfiltration primitive: if upstream components can influence the recipient, body, or file path, sensitive local files or generated content could be emailed out silently.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes sending translated papers by email, but the documentation also states that completed jobs proactively notify a QQ target. Sending messages to a separate messaging channel is an additional communication capability that is not part of the declared purpose of downloading, translating, and emailing papers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The module docstring is written only in Chinese and provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.