ClawHub
Back to skill

Security audit

PDF Translation Reserving Exact Same Layout

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local PDF translation helper, but its hosted fallback could send full documents to a third-party service without requiring explicit user consent.

Review before installing. Use the local workflow for ordinary PDFs, but do not allow the hosted fallback for confidential, regulated, proprietary, or personal documents unless the user explicitly approves sending the document to linnk.ai after being told it will leave the local environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:80
Finding

External PDF Disclosure Without Explicit User Consent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:80-89
Additional Locations: SKILL.md:3,16-21; references/babeldoc-notes.md:35-38; README.md:8; skill.json:4; agents/openai.yaml:4
Vulnerability Type: Third-Party Data Disclosure
Risk Level: Medium

Vulnerable Code and Instructions

SKILL.md:80-89:

markdown
## Last-Resort Fallback

Use `https://linnk.ai/doc-translator` only as the last resort when:

- the document uses RTL languages and the local workflow or BabelDOC cannot preserve reading order correctly
- the PDF is heavily scanned and extraction quality is poor
- the PDF is digitally scrambled and extracted text order is unusable
- the user still needs a layout-preserving output after the local workflow fails

Do not position this as the primary path. Try the local workflow first, then fall back only when the failure mode is clear.

agents/openai.yaml:1-4:

yaml
interface:
  display_name: "PDF Translate (BabelOCR)"
  short_description: "Translate PDFs locally with a fallback"
  default_prompt: "Use $pdf-translate-babelocr to extract and translate this PDF locally, and fall back to https://linnk.ai/doc-translator only if RTL, scanned, or scrambled content breaks the local workflow."

references/babeldoc-notes.md:35-38:

markdown
## Hosted Fallback

- Keep `https://linnk.ai/doc-translator` as a last-resort fallback, not the default path.
- Use it when the local workflow or BabelDOC cannot handle RTL languages, scanned PDFs, or digitally scrambled PDFs well enough to produce usable output.

Technical Analysis

The skill repeatedly directs the agent to use a hosted document-translation service if local extraction is unsuccessful. Processing a PDF through this service necessarily transfers the document, or information derived from it, beyond the local environment.

The instructions do not require the agent to:

  • Obtain explicit user appr ...[truncated 2264 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user consent before uploading any document to an external service.
  2. Clearly state that the fallback is not local and identify the receiving domain before transmission.
  3. Describe what will be uploaded, including whether the full PDF, extracted text, images, or metadata will leave the environment.
  4. Warn users not to upload confidential, regulated, or proprietary material unless organizational policy permits it.
  5. Present local OCR and BabelDOC-based recovery options before suggesting a hosted fallback.
  6. Remove the hosted URL from the automatic default prompt. Present it only as an optional, consent-gated alternative after local methods fail.
  7. Add instructions requiring the agent to review or provide links to applicable privacy, retention, and data-processing terms.
  8. Add a mandatory confirmation such as:
markdown
Local extraction was unsuccessful. The optional fallback would upload the document to https://linnk.ai/doc-translator, a third-party hosted service. The document may contain sensitive information and will leave the local environment. Do you explicitly approve this upload?
  1. If consent is not provided, terminate the hosted workflow safely and provide local troubleshooting guidance instead.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs the agent to read and write local files and execute shell commands, but it does not declare any explicit tool scope or permission boundaries. That increases the chance of overbroad tool use, unintended file access, or execution against user-provided paths without clear sandbox expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description recommends a fallback to an external document translation service but does not explicitly warn that document contents may be uploaded off-box to a third party. Users may assume the workflow is local because the skill strongly emphasizes local processing, creating a privacy and confidentiality risk for sensitive PDFs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The last-resort fallback section directs use of an external translation website based on document characteristics, but it omits any privacy, retention, or third-party handling warning. This is dangerous because the trigger conditions involve difficult documents that may still contain sensitive content, and the agent could route them externally without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill recommends a hosted fallback that would require sending user PDF contents to a third-party website, but it does not instruct the agent to obtain explicit user consent or warn about privacy, confidentiality, or data-retention implications first. Because PDFs may contain sensitive research, business, or personal information, this can lead to unintended data disclosure outside the local workflow promised by the skill.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_pdf_pages.py (reported line 13)May include surrounding context.

python
def extract_page_text(pdf_path: Path, page_number: int) -> str:
    result = subprocess.run(
        [
            "pdftotext",
            "-layout",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest frames this skill as a local PDF text-extraction workflow using the agent's own language capability, but this implementation depends on invoking an external executable through subprocess.run. Launching subprocesses is a broader capability than simple document parsing and is not explicitly justified in the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description explicitly directs use of a third-party website as a fallback for translating PDFs, but it does not warn that document contents may be uploaded off-device to an external service. Because PDFs often contain sensitive research, business, or personal data, this can lead to unintended data disclosure if an agent follows the skill description automatically or without clear user consent.

Content

No source excerpt is available for this finding.