Double6 PDF Translation

• Outcome: Review
• Latest audit: Jul 31, 2026 · 7:55 PM UTC
• Version: 1.0.4

Overview

The skill is purpose-aligned for PDF translation, but it needs Review because API keys can be exposed in child process arguments and document text is retained in diagnostic artifacts.

Install only if you are comfortable with full PDF text being sent to your selected model endpoint and retained in the output directory. Use this on a trusted single-user machine, keep output folders private, prefer approved endpoints for confidential PDFs, and avoid enabling arXiv, Docker, cloud layout, or the compatibility proxy unless you need them. Treat API keys as exposed to local process inspection until the command-line key handling is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill manifest does not declare permissions in a machine-enforceable way, while the documented behavior clearly requires file read/write, network, environment access, and shell execution. This creates a governance gap: hosts or reviewers may underestimate the privileges needed and allow execution without appropriate review or sandboxing, increasing the chance of unintended data exposure or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose says outputs and runtime effects are constrained, but the detected behavior is materially broader: default home-directory caches, authenticated preflight network probing, optional OCR, non-PDF input handling, and additional diagnostic/PDF mutation capabilities. This mismatch is dangerous because users and orchestration systems may authorize the skill under a narrower trust model than the code actually requires, leading to unexpected data transmission, filesystem writes outside the chosen output directory, and execution of more powerful workflows than intended.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: When no local source is found, the returned selection metadata still uses policy values like 'explicit_latex_only' even though the function may inspect PDF metadata and, with opt-in, download source from arXiv. This can mislead downstream audit/UI components about what actually happened, weakening user awareness and security review of network-enabled behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The backend command includes both document content handling and direct transmission parameters for external model endpoints, including the API key on the command line. Sending extracted PDF text to remote services is an intended feature, but placing credentials in argv is dangerous because command-line arguments can be exposed to other local users or process-monitoring tools, and remote transmission of document text can leak sensitive content if users are not adequately informed or constrained.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script sends user-provided source text, glossary, policy, and extra instructions to a configurable OpenAI-compatible endpoint via post_chat(), but there is no in-script consent gate, warning, or restriction that ensures the user is explicitly informed at execution time that document contents will leave the local process. Because the input may contain confidential paper drafts, unpublished research, or sensitive embedded data, this creates a real data exfiltration/privacy risk if the endpoint is remote or misconfigured.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This code sends extracted user PDF text verbatim to a configured upstream OpenAI-compatible endpoint in `_post_upstream_payload`, which is a real confidentiality boundary crossing. In this skill’s context that behavior is expected for translation, but it still exposes potentially sensitive document contents to a remote service and this file itself provides no runtime consent, minimization, or redaction controls.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The proxy stores source text, translated output, normalized text, page metadata, and samples in in-memory stats/ledger structures, which creates an avoidable secondary retention channel for sensitive user document content. Even if not persisted by this file directly, these structures increase exposure to accidental logging, debugging dumps, crash reports, or later introspection by other local components.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The script persists item-level translation inputs and outputs into translation_proxy_ledger.json, which can retain sensitive user document content in plain artifacts under the output directory. Because this skill processes user-supplied PDFs and may handle confidential papers or proprietary material, that retention materially increases confidentiality risk if the directory is shared, synced, or later exposed.

Tool Parameter Abuse

Low

• Category: Tool Misuse

Content

set -eu
image="${{PDF2ZH_TEX_DOCKER_IMAGE:-paper-translation-tex:2026-05-21}}"
work="$(pwd)"
exec docker run --rm -v "$work:/workspace" -w /workspace "$image" {tool} "$@"
"""
    for tool in ("xelatex", "lualatex", "pdflatex", "bibtex", "latexmk"):
        path = wrapper_dir / tool

• Confidence: 91% confidence
• Finding: rm -v "$work:/workspace" -w /

VirusTotal

56/56 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.