PDF Math Translate

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.0

Overview

This skill is a short, purpose-aligned guide for PDF translation, with no bundled executable code, but users should treat online demos, translation providers, and unpinned install commands cautiously.

Before installing or using this skill, avoid submitting confidential, unpublished, regulated, or proprietary PDFs to online demos or cloud translation providers unless you have reviewed their data handling. Prefer a locally verified deployment for sensitive documents, and pin package or Docker versions where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Unpinned and Unverified Third-Party Package and Container Execution

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 24-33
Vulnerability Type: Supply-chain exposure through mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code:

bash

docker run -p 8501:8501 pdfmathtranslate

bash

uv pip install pdfmathtranslate

# Or use pip
pip install pdfmathtranslate

Technical Analysis

The documented installation commands execute third-party artifacts without pinning an immutable version, package hash, container registry, publisher namespace, or image digest.

The Python commands resolve the current release named pdfmathtranslate from the package index configured on the user's system. Consequently, the installed artifact may change after this skill has been reviewed. The abbreviated Docker image reference similarly leaves its registry and publisher provenance implicit and does not guarantee that users will receive a previously audited image.

This creates supply-chain exposure if the package repository, publisher account, configured package index, or container tag is compromised. It may also expose users to unreviewed behavior introduced by an unexpected upstream update. The finding concerns insecure dependency instructions; no evidence within the reviewed files establishes that the current upstream package or image is malicious.

Attack Path

1. An attacker compromises the relevant package or container publisher, poisons a configured dependency source, or causes a mutable release or image tag to resolve to attacker-controlled content.
2. A user follows one of the documented installation or Docker commands.
3. The package manager downloads and installs the attacker-controlled Python distribution, or Docker downloads and starts the substituted image.
4. Malicious package installation or runtime code executes in the user's environment. A malicious container can also expose attacker-controlled functionality through host port 8501.
5. T ...[truncated 825 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Python dependency to a specifically reviewed version rather than installing the latest mutable release.
2. Publish a lock file containing cryptographic hashes and require hash verification during installation, such as pip's --require-hashes workflow.
3. Use a fully qualified official container reference, including the trusted registry and publisher namespace.
4. Pin the container image by immutable digest, for example registry.example/official/pdfmathtranslate@sha256:..., after verifying and auditing that image.
5. Document how users can verify package signatures, image provenance, publisher identity, and checksums.
6. Run the application as a non-root user with a read-only filesystem, minimal Linux capabilities, restricted network access, and no unnecessary host mounts or secrets.
7. Bind the service to localhost unless remote access is explicitly required, and place authentication and transport security in front of any externally reachable deployment.
8. Add a privacy warning for confidential PDFs and recommend a verified local deployment when documents must not be disclosed to external providers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes online demos and multiple translation providers for processing PDFs but does not warn that uploaded documents may be transmitted to third-party services. Because scientific PDFs may contain unpublished research, personal data, or confidential material, users may unknowingly expose sensitive content outside their environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The README instructs users to run a Docker image by name only, without a pinned tag or immutable digest. This can cause users to pull an unexpected or modified image over time, increasing supply-chain risk if the latest tag changes or a registry compromise occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly promotes online use and integration with third-party translation providers, but it does not disclose that uploaded PDF contents may leave the local environment and be transmitted to external services. For scientific PDFs, this can expose unpublished research, proprietary data, regulated documents, or sensitive annotations, creating a real confidentiality and compliance risk through omission rather than direct code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.