Security audit

PDF 翻译

Security checks for vulnerabilities and agentic risk

Overview

This is a local academic PDF translation skill whose file, script, agent, and workspace behavior is disclosed and aligned with that purpose.

Install only if you are comfortable with a local workflow that copies provided PDFs into the skill Workspace, keeps hidden work files until you delete them, records absolute paths in job metadata, and runs PDF/image parsing libraries on your documents. Use an isolated environment for untrusted PDFs and review the final translation before relying on it for high-stakes work.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The renderer contradicts its stated behavior by drawing only content[:120] for each text block, silently truncating translated text. In this skill’s context—academic PDF full-text translation and searchable reconstruction—this can cause material omission, incomplete searchability, and misleading output that appears successfully rendered while dropping most of the source content.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill metadata promises readable, searchable full-PDF reconstruction, but the implementation only emits the first 120 characters of each block. For academic documents, this can systematically omit methods, results, citations, warnings, formulas, or conclusions, producing untrustworthy translated PDFs while giving users false confidence that the document was fully reconstructed.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The skill explicitly directs the agent to use Bash and Python to render PDF pages, which introduces active code/tool execution against potentially untrusted documents and file paths. In a translation pipeline handling arbitrary academic PDFs, this expands the attack surface and can lead to unsafe command construction, processing of malicious files, or unintended local access if not tightly constrained.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow explicitly stores users' original file paths and later requires absolute output paths in records and user-facing delivery messages. Absolute paths can reveal usernames, home directory structure, project names, mounted volumes, or other sensitive environment details, and this skill provides no minimization, redaction, or consent guidance. In this context, the issue is more dangerous because the skill is designed for document processing and batch handling, so path metadata may be propagated into logs, JSON state, and final replies repeatedly.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

Category: Supply Chain
Confidence: 87% confidence
Finding: This skill processes untrusted PDFs and embedded images, making Pillow a high-risk dependency because image decoders are exposed directly to attacker-controlled content. If the allowed version range includes releases affected by resource exhaustion or code-execution-class issues, a crafted document could crash the process or potentially achieve code execution during translation or reconstruction workflows.

Known Vulnerable Dependency: reportlab — 8 advisory(ies): CVE-2023-33733 (Reportlab vulnerable to remote code execution); CVE-2020-28463 (Server-side Request Forgery (SSRF) via img tags in reportlab); CVE-2019-19450 (ReportLab vulnerable to remote code execution via paraparser) +5 more

Critical

Category: Supply Chain
Confidence: 93% confidence
Finding: ReportLab has a history of serious parser and rendering vulnerabilities, and this skill uses it to rebuild translated PDFs from content derived from potentially untrusted source documents. In this context, vulnerabilities such as RCE-class parser bugs or SSRF-relevant fetch behavior are especially dangerous because the package sits in the document-generation path and may process attacker-influenced text or markup.

Static analysis

No suspicious patterns detected.