Security audit

PDF: перевод на русский с сохранением вёрстки

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent PDF-to-Russian translation workflow that reads a user-provided PDF, stores job state locally, and produces a translated PDF without hidden network or persistence behavior.

Install only if you are comfortable with the skill storing the source PDF, extracted text, OCR output, translations, and final PDF in its local job state, and possibly a user Deliverables folder for sending the file. Avoid using it for documents whose contents should not persist in those locations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Заявленное назначение — полноценный офлайн-переводчик PDF с сохранением оформления и поддержкой сканов через OCR. Фактический код лишь читает локальный markdown-справочник и печатает его содержимое или список доступных тем. Это не вспомогательная внутренняя часть перевода PDF, а совершенно иной по основной функции компонент: справочное руководство. Доступ к файловой системе соответствует заявленному permission 'fs', но основное поведение существенно расходится с описанием навыка.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Описание заявляет конечную пользовательскую функцию: перевод PDF с сохранением макета, графиков и оформления, включая обработку сканов. Однако данный фрагмент реализует только вспомогательный этап пайплайна: приём PDF, извлечение текстового слоя, классификацию страниц, локальный OCR, чтение текста страниц и рендеринг PNG для проверки. В коде нет логики машинного перевода, замены английского текста русским на странице или сборки переведённого PDF; наоборот, он явно ссылается на другие компоненты вроде translate.py extract/build для следующих шагов. Разрешение fs соответствует поведению: код читает входной PDF и пишет состояние задания на диск. Но основное назначение этого конкретного куска кода существенно уже и отличается от заявленного описания, поэтому это mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
`SKILL.md`; `scripts/` — `pdf.py`, `translate.py`, `guide.py`, модули `_core.py`, `_ocr.py`;

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
`SKILL.md`; `scripts/` — `pdf.py`, `translate.py`, `guide.py`, модули `_core.py`, `_ocr.py`;

Lp1

High

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The module reads multiple environment variables, including OUROBOROS_SKILL_STATE_DIR, OUROBOROS_SKILL_NAME, PDF_SKILL_STATE_DIR, and PDF_SKILL_INPUT_ROOTS, to influence filesystem scope and trusted input roots. In a sandboxed skill model, undeclared environment-variable dependence can expand data access beyond what reviewers expect and can weaken trust assumptions if the runtime injects unexpected values.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description states the skill translates PDFs specifically "на русский", making a fixed language choice part of the skill behavior. This is a natural-language locale/language constraint, and the file does not present any user choice or opt-in for alternative output languages.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title and surrounding instructions define the skill as "PDF → перевод на русский" and the rest of the workflow assumes Russian translation only. Because no language selection or opt-in is offered, this is a natural-language policy issue under the language/locale rule.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file title explicitly requires translation of business documents into Russian, which imposes a fixed language/locale behavior. The instructions throughout the file reinforce Russian-only output, but there is no indication of user opt-in, configurable language choice, or a documented organizational reason limiting the skill to this locale.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module docstring states that one of the core responsibilities is "русскую типографику," and multiple user-facing messages throughout the file are written only in Russian. This indicates a language/locale constraint without any visible user opt-in or explanation that the skill is intentionally region-specific, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring and surrounding natural-language comments are written entirely in Russian, and the file does not indicate that language choice is configurable or limited to a justified region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The docstring states that the translate command provides rules for translating a business document into Russian, and the user-facing command descriptions are only in Russian. This indicates a fixed language/locale behavior without offering the user a choice or documenting an opt-in, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring and all user-facing command/help text are written only in Russian, which imposes a language choice on users. Under the stated policy, locale or language restrictions should either be optional for the user or clearly justified as region-specific, and this file provides neither.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and command descriptions explicitly define the skill as translating PDFs into Russian and repeatedly instruct the agent to produce Russian text. This is a natural-language locale policy constraint with no visible opt-in or alternative language choice in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The build command writes and replaces multiple files, including temporary and final PDF outputs, progress state, and fit metadata. In this code file, these file-writing side effects are not accompanied by a visible confirmation prompt or explicit user-facing disclosure at the point of execution, which matters because the operation changes persistent artifacts and can overwrite prior outputs.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The build response explicitly instructs the operator to copy the generated PDF into an external user-accessible directory (/data/user/Deliverables/). That expands the skill’s effective data-handling scope beyond in-skill translation and can cause unintended disclosure or persistence of potentially sensitive document contents in another location without explicit user consent or a constrained handoff mechanism.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 30% confidence
Finding: В модульном докстринге заявлено, что ядро не использует сеть и не запускает дочерние процессы. Однако в коде есть логика альтернативного импорта fitz при отсутствии pymupdf, что показывает расхождение между заявлением о строгом поведении и фактической гибкостью реализации. Это слабое и малозначимое расхождение, но оно затрагивает намерение, описанное в документации.
Content: No source excerpt is available for this finding.