长文档全文翻译流水线

• Outcome: Pass
• Latest audit: Oct 23, 2026 · 10:16 AM UTC
• Version: 1.3.18

Overview

The skill’s translation workflow is purpose-aligned and reasonably scoped, with installation, OCR privacy, and output-quality caveats.

Use reviewed installation versions and keep manuscript backups before applying cleanup. Read QA reports rather than trusting exit codes alone, and manually check duplicate passages. Confirm the optional OCR service’s privacy practices before submitting sensitive documents; its use is unnecessary when you already have text.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied chunk's primary purpose is packaging a skill for distribution, materially different from the declared translation and document-production workflow. Although packaging can be auxiliary tooling, this code has no demonstrated connection to generating or validating the declared deliverables. Its filesystem operations serve package creation rather than document processing. No network requests, uploads, or shell execution occur; marketplace URLs are only printed.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documented installation command uses npx skills without pinning the npm package version, potentially downloading and executing a changing package with the invoking user's permissions. Although the scanner incorrectly describes this CLI as an MCP server, the underlying supply-chain risk is real: a compromised release could execute malicious code when the installation guidance is followed. Its appearance in a changelog rather than an automatic execution path reduces immediate exposure.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documented installation command uses an unpinned npx skills package and an unpinned skill repository, allowing the installed content to change without review. Although the detector incorrectly describes this CLI invocation as an MCP server reference, the underlying supply-chain risk is real: a compromised package release could execute code with the invoking user's permissions, and altered skill content could introduce malicious agent instructions. This is a conventional installation instruction rather than evidence of malicious intent, but the offline behavior claimed for core scripts does not protect the installation step.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The installation command invokes npx skills without pinning the package version, allowing installation-time execution of a changing dependency with the user's permissions. This is an executable dependency supply-chain risk rather than an unpinned MCP server; the referenced skill repository is also not fixed to an immutable revision.

Content

No source excerpt is available for this finding.

The OCR workflow lacks a privacy warning about sending source documents to the parsing service.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The README recommends an optional MCP parsing service for source documents without explaining whether document contents leave the host or requiring informed approval before external processing. Authorized access to a book or archive does not necessarily authorize disclosure to a third-party service, and archival material may contain sensitive information; however, the supplied file does not establish the parser's deployment or actual data handling.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The documented release-blocking safety check only warns and still produces the archive.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The header promises that failed release checks prevent archive creation, but security-pattern matches only generate warnings and packaging proceeds unconditionally. This fail-open behavior can allow unsafe scripts into a distributable skill archive despite the advertised safety gate; exploitation would require unsafe content to enter the skill directory and subsequently be used, since packaging itself does not execute those scripts. The translation skill has no obvious need for unrestricted command execution, making unreviewed matches relevant, although individual pattern matches can be benign.

Content

No source excerpt is available for this finding.

Tainted flow: 'OUT_HTML' from os.environ.get (line 23, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/build_reader.py (reported line 294)May include surrounding context.

python

body.count('class="fnref"'),
                        body.count('class="pagemark"'),
                        n_terms, n_doubts)))
    open(OUT_HTML, "w", encoding="utf-8").write(html)
    print("reader html:", OUT_HTML, len(html), "chars")
    print("  脚注链接 %d / 页边码锚点 %d" % (body.count('class="fnref"'),
                                            body.count('class="pagemark"')))

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_translation.py (reported line 57)May include surrounding context.

python

def run(script, *args):
    r = subprocess.run([sys.executable, '-B', script] + [str(a) for a in args],
                       capture_output=True, text=True)
    return r.returncode, r.stdout + r.stderr

Page-marked duplicate paragraphs are retained despite documentation promising to keep only the page marker.

Medium

• Category: Excessive Agency
• Confidence: 100% confidence

Finding

When a duplicate contains a page marker, the script appends the marker but subsequently reaches the unconditional out.append(l), retaining the duplicate paragraph as well. With --apply, this modifies the document while incorrectly reporting successful deduplication, undermining the translation workflow's output integrity and verification anchors. This is a limited integrity defect, not evidence of malicious behavior or a broader security compromise; default dry-run operation reduces its impact.

Content

No source excerpt is available for this finding.

An embedded translator note instructs reviewers to exempt its content from reporting.

Medium

• Category: Prompt Injection
• Confidence: 86% confidence

Finding

The note claims that its location in an annotation section means it “must be exempted” and must not be reported as untranslated residue. This goes beyond describing the text: it attempts to make the material under review dictate the reviewer's reporting rules, using a plausible editorial exception to suppress a finding.

Content

No source excerpt is available for this finding.

Tainted flow: 'out_html' from os.environ.get (line 386, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/merge_build.py (reported line 358)May include surrounding context.

python

<body><div class="layout">{nav}<main>
{body}
</main></div></body></html>"""
    open(out_html, "w", encoding="utf-8").write(html)
    return True

Tainted flow: 'md_path' from os.environ.get (line 382, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/merge_build.py (reported line 383)May include surrounding context.

python

else:
        master, n_files, _ = merge(chunks_dir)
    md_path = out_prefix + ".md"
    open(md_path, "w", encoding="utf-8").write(master)
    print(f"✅ 主稿已生成：{md_path}（{len(master)} 字符）")
    html_path = out_prefix + ".html"
    if build_html(master, html_path):

The documented character-based overlap fallback is not implemented.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The documented character-based fallback is absent: files without page markers are skipped, and an entirely markerless input produces a warning but exits successfully without checking overlap. An automated workflow that treats exit code 0 as validation success could therefore accept duplicate translation content; mixed inputs can also leave unchecked gaps between comparisons. This is primarily a validation-integrity issue in the translation workflow, not evidence of malicious behavior or code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.