T08 · Insecure Dependencies
Warning
- Location
scripts/run_pipeline.py:28- Finding
Unverified External Python Runtime Is Imported and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
Academic Paper Translator
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent as a Chinese academic-paper translation workflow, but it should be reviewed before installation because it can automatically process local documents with broad local tooling and includes unsafe runtime-loading and PowerShell execution guidance.
Review before installing. Use it only on papers you are allowed to process, expect local caches and DOCX outputs to be written beside the paper unless redirected, and avoid running the Windows PowerShell command with ExecutionPolicy Bypass. Only point --argos-runtime at a trusted, pinned Argos installation, and consider approving Image2/model use and any network lookup explicitly for sensitive or unpublished papers.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:182- Finding
PowerShell Renderer Is Invoked with Execution-Policy Bypass
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a comprehensive academic translation workflow. The actual code chunk only implements citation-linking behavior inside a Word document: it identifies a references section, bookmarks numbered entries, hyperlinks matching in-text numeric citations to those bookmarks, and hyperlinks DOI strings to doi.org URLs. This citation-linking feature is mentioned in the description as one component, but the overwhelming majority of the declared functionality—translation, bilingual output creation, handling full papers, figure-text translation, and producing two default DOCX deliverables—is absent from the code. Therefore the code chunk does not accurately represent the declared purpose and has a materially different primary purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose describes a document-translation skill for academic papers with structured bilingual/DOCX outputs and scholarly-link preservation. The supplied code does none of that. It only scans a directory for page-*.png files, resizes them into thumbnails, lays them out on contact sheets, labels each thumbnail, and saves PNG outputs. This is a materially different primary purpose and an unrelated capability, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for a comprehensive academic-paper translation skill that outputs two translated DOCX files and handles references, figures, and links. The supplied code does none of that. It operates only on already-existing DOCX files, inspects embedded images inside them, compares image hashes across a Chinese-only and bilingual document, and emits a JSON manifest for pending visual audit. This is a materially different primary purpose and capability set from translation, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear material mismatch between the declared description and the code’s actual behavior. The description promises an end-to-end academic translation workflow for scholarly documents, including bilingual output generation and citation/link enhancements. The code instead implements a narrow file-manipulation function: replacing an exact embedded media member inside a DOCX package. While it operates on DOCX files, that is only superficial overlap; its primary purpose is image/media replacement, not translation or document production. No undeclared dangerous behavior is evident beyond the stated file rewrite operation, but the actual capability is unrelated to the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code is related to the declared domain—academic paper PDF to Chinese/bilingual DOCX translation—but the description materially overstates what is actually implemented. The pipeline extracts textual records from PDF pages, translates only body text via Argos, leaves references in English, and builds two DOCX files. However, the implementation explicitly labels non-final output as 'machine draft' and even in --final mode states that figure and link postprocessing are still required. There is no image/figure OCR or translation, no table or equation preservation logic, no DOI hyperlink generation, and no citation-to-reference linking beyond adding bookmarks on reference entries. Therefore the description does not accurately represent the current code behavior and promises significant capabilities not present in this chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description says the skill translates complete academic papers and produces two polished DOCX outputs. The code shown does not do any translation or document generation. Instead, it validates that already-produced Chinese and bilingual DOCX files, plus an image manifest and optional translation cache, satisfy strict structural and metadata requirements. While these checks are related to the claimed workflow, the primary behavior is materially different: auditing/validation rather than translation/delivery creation. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a comprehensive academic translation skill with document conversion and output generation capabilities. The actual code does not translate text, read PDFs for translation, produce DOCX outputs, or handle figures, equations, tables, or bilingual alignment. Instead, it only opens an existing DOCX as a ZIP archive, parses document XML and relationship files, checks for bookmark names matching ref_\d+, verifies internal hyperlink anchors and DOI links, prints counts/errors, and returns a pass/fail status. While this validator could be a small supporting component of a larger translation workflow, the supplied code chunk's actual behavior is materially narrower and different from the declared primary purpose, so this is a clear mismatch.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states the skill translates papers into 'polished Simplified Chinese DOCX files,' establishing a fixed output language. The invocation and usage text do not offer any language choice or opt-in, which conflicts with the policy against forcing a specific language or locale without user selection.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The canonical instruction explicitly requires generation of Chinese-only and bilingual Chinese output and directs the AI to start immediately without clarifying questions. Because no alternative language option or opt-in flow is provided, this is a natural-language locale policy violation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Requires an actual Image2 edit for every raster figure containing semantic English; captions and translation panels do not count. - Keeps original and localized figures together in the bilingual edition. - Adds WPS-compatible citation navigation and clickable DOI links. - Starts immediately from a supplied paper and uses resumable source-ID translation state without asking setup questions. - Renders DOCX files through installed Microsoft Word or WPS on Windows; LibreOffice is not required. - Applies hard quality gates for paragraph alignment, Image2 hashes, figure pairing, references, navigation, and rendered-page integrity. - Uses no arbitrary translation time limit; verified quality takes priority.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Usage > Use Academic Paper Translator now. Without asking setup questions, completely translate this English paper. Deliver an Image2 Chinese-only DOCX and a paragraph-aligned English–Chinese DOCX, preserve equations and English references, add WPS Ctrl+click citation jumps and DOI links, render every page through Word/WPS, and repair all validation failures before returning the files. ## Citation navigation and literature lookup
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The usage example says to 'completely translate this English paper' and deliver a 'Chinese-only DOCX' plus bilingual output, but it does not indicate that Chinese is user-selected. This presents a default forced language behavior rather than an offered choice.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares broad operational behavior but provides no explicit tool/permission scoping, while the analysis indicates file and environment capabilities are in play. In an agent setting, missing tool restrictions can let the workflow access local files or environment data beyond what is necessary, increasing the blast radius if the skill is misused or if downstream instructions are compromised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description requires translating papers into polished Simplified Chinese as the default behavior. This is a natural-language locale constraint, and the file does not present it as an opt-in choice or justify it as a region-specific compliance requirement.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
The skill strongly instructs the agent to proceed immediately, infer parameters, and avoid confirmation questions, which increases autonomous action on user files. In combination with file read/write behavior and document generation, this reduces human oversight and can cause unintended processing, overwrites, or handling of sensitive documents without explicit approval at important decision points.
- Content
md When the user supplies a paper file (or a readable local path/attachment) and asks for translation, start the complete workflow immediately and deliver the two default DOCX files in the same response. Do **not** ask setup, formatting, terminology, output-name, output-folder, figure-style, reference-link, or confirmation questions: this skill already defines their defaults. Infer the Chinese title from the paper title; use the source file's directory as the output directory unless the user specifies another location. Use the translation standard, terminology ledger, figure workflow, DOCX styling, bilingual layout, citation navigation, and QA rules in this skill without asking the user to select them. Ask a single concise blocking question only when no paper can be accessed, the supplied file is unreadable/corrupt/password-protected, essential pages are missing, or a requested destination cannot be written. If any non-blocking ambiguity remains, make the best evidence-based choice, record it in the final report, and continue. Never pause merely to preview a plan or obtain permission to begin the translation.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 83% confidence
- Finding
The fallback policy directs the agent to choose among bundled tools, local runtimes, and model-based generation without asking the user, including use of installed Office/WPS automation on Windows. That broad autonomous capability selection can unexpectedly invoke local applications, process sensitive files, or exercise more privilege than the user intended, especially in desktop agent environments.
- Content
md ### Capability fallback order Use this order without asking the user: (a) bundled PDF/document/image tools; (b) installed local runtimes and libraries; (c) the model's own translation and structured document-generation ability. A missing optional helper is never a blocker. Only an inaccessible source, an unwritable destination, or a genuinely unavailable mandatory Image 2/image-edit capability may block delivery, and the final report must name the exact blocked artifact. On Windows, absence of `soffice` is not a blocker when Microsoft Word or WPS is installed. Use `scripts/render_docx_windows.ps1`, which tries `Word.Application` first and `KWPS.Application` second, exports the DOCX to PDF, and rasterizes every page with Poppler. Do not incorrectly report that rendering is unavailable merely because a LibreOffice-only helper cannot find `soffice`.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow directs the agent to use natural academic Simplified Chinese, making a specific language/script mandatory. Because the policy category applies to all file types, this is a locale-policy issue unless the user is given a choice or the constraint is explicitly justified.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The instruction to use DOI resolution and other full-text access routes expands the skill from processing a supplied paper to potentially retrieving additional content over a network. In agent environments, that can trigger unintended outbound access, pull in untrusted remote content, or access subscription-backed resources without explicit user approval.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description and default prompt force Chinese and bilingual output by default rather than waiting for the user's language preference. This is not a classic security bug, but it is a genuine prompt-safety issue because it overrides user agency and can cause unintended disclosure, transformation, or mishandling of content when the requested output language or format differs.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The instruction "Without asking setup questions" pushes the agent toward autonomous decision-making about document handling, formatting, file generation, repair actions, and tool usage without confirming assumptions. In this skill context, that is more dangerous because the prompt also directs rendering through Word/WPS, repairing failures, and returning only completed files, which suppresses opportunities for user review and can drive unsafe or incorrect automated actions.
- Content
yaml interface: display_name: "Academic Paper Translator" short_description: "Complete Chinese and bilingual academic DOCX translation" default_prompt: "Use $translate-academic-papers now. Without asking setup questions, completely translate the supplied English paper and deliver two verified DOCX files: an Image2 Chinese-only edition and a paragraph-aligned English-Chinese edition containing each original figure followed by its Image2 Chinese version. Preserve equations and English references, add WPS Ctrl+click citation jumps and official DOI links, render every page through Word/WPS, repair all failures, and return only the completed files plus a concise QA report."
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The default prompt contains a broad activation phrase ("Use $translate-academic-papers now") and then imposes a long chain of mandatory actions without clear trigger boundaries or user confirmation. This can cause the agent to invoke the skill too eagerly and process arbitrary supplied documents in a fixed way, increasing the chance of unintended execution and unsafe automation in downstream tooling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to create an English-to-Chinese label map and the repeated requirement that delivered figures contain Chinese translations establish a fixed language policy. The file does not offer user opt-in or explain a region-specific justification for forcing Chinese, which matches the locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document requires a Chinese full-text edition and Chinese translations throughout, and instructs use of translated Chinese titles, headings, figures, and captions. This is a natural-language locale policy constraint that forces a specific language without stating that the user can choose or opt in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction says figure text replacement should be accepted only after confirming in-place Chinese replacement. This imposes a specific language requirement in natural-language guidance without any indication of user opt-in or a documented region-specific justification, which matches the locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document instructs the skill to 'Use fluent, formal Simplified Chinese' and to use Chinese punctuation, which imposes a specific language/locale requirement. Under the policy, forcing a language without explicit user choice or opt-in is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.