Security audit

Doc Translate

Security checks for vulnerabilities and agentic risk

Overview

The skill is a document translation tool, but it overstates its translation capabilities and gives broad document download/upload instructions without enough scoping for sensitive files.

Review this skill before installing. It should be treated as a limited English-to-Chinese replacement tool, not a general translator. Use it only on trusted documents or inside a constrained environment, and require explicit user approval before downloading, storing, translating, sending, or uploading sensitive files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/pptx_translate.py:186
Finding: Unbounded PPTX Archive Extraction Enables Resource Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/docx_translate.py:82
Finding: Unbounded DOCX Archive Extraction Enables Resource Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/xlsx_translate.py:66
Finding: Unbounded XLSX Archive Extraction Enables Resource Exhaustion
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad Office document translation toolkit covering PPT/Word/PDF/Excel and arbitrary language translation while preserving formatting. The actual code only processes DOCX files by extracting the ZIP archive, scanning XML files, and replacing matching English phrases with Chinese using a fixed mapping table. There is no evidence of PPT, PDF, or Excel support, no general translation engine, and no arbitrary language capability beyond an empty fallback mapping. The formatting-preservation claim is broadly consistent with XML in-place editing for DOCX, but the overall declared scope materially exceeds the implemented behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad Office document translation/localization toolkit covering PPT, Word, PDF, and Excel, with preservation of original formatting and support for English-to-Chinese or arbitrary language translation. The supplied code only handles PDFs. Its primary implemented workflow extracts plain text from each PDF page, performs simple hardcoded replacements, writes a new DOCX with generic headings, and converts that DOCX back to PDF using LibreOffice. That materially differs from preserving the original document template/format. Additionally, the code does not implement true translation functionality for arbitrary content or languages; it only replaces a few fixed English words with Chinese equivalents. The alternate 'direct' PDF-preserving method is explicitly unfinished. Therefore the code does not accurately match the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 描述与代码存在实质不符。代码文件名和逻辑都明确限定为 PPTX 翻译；输入参数也是 <input.pptx>，处理方式是解压 Office Open XML 并修改 XML 中的文本节点。虽然保留模板/格式这一点与描述大体一致，但其能力范围远小于声明：没有任何 Word、PDF、Excel 解析或翻译逻辑，也没有调用通用翻译引擎。load_translations 仅在 src_lang='en' 且 tgt_lang='zh' 时返回一个硬编码词条表，否则返回空列表，因此“任意语言”支持不成立。此外，翻译内容明显针对某一特定演示文稿/产品资料，而非通用办公文档翻译工具集。未发现额外危险或无关的越权行为，但核心功能声明被明显夸大。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad office-document translation suite covering PPT, Word, PDF, and Excel, with multilingual translation capability. The supplied code chunk implements only an Excel XLSX translator. Even within Excel, it is not a general translation engine: it performs a limited set of hardcoded English-to-Chinese replacements and returns no translations for other language pairs. There is no evidence of PPT, Word, or PDF handling. While the code does preserve XLSX structure by editing XML inside the archive and re-zipping it, that does not substantiate the broader declared scope. Therefore the description materially overstates the code's actual capabilities.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs use of shell commands and local file processing but does not declare any explicit tool scope or permission boundaries. That creates unnecessary ambiguity around what execution and filesystem capabilities the agent may use when handling untrusted documents, increasing the risk of overbroad access or unsafe command execution in downstream implementations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases include broad everyday language such as generic document-translation requests, which can cause the skill to activate in contexts the user did not clearly intend. Overbroad activation is risky here because the skill handles downloading, modifying, and transmitting user files, so accidental invocation can lead to unnecessary document access and data movement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs downloading from Feishu or local paths, saving outputs, and re-sending files, but does not warn users that their documents may be copied, stored temporarily, or transmitted through external channels. For document workflows, this omission is security-relevant because users may unknowingly expose sensitive business, legal, or medical files to broader handling than expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Defaulting output to Chinese without explicit user opt-in is mostly a consent and integrity issue rather than a severe exploit, but it can still cause unintended disclosure or business errors if documents are transformed and redistributed in the wrong language. In sensitive workflows, silent language conversion can alter meaning and trigger downstream misuse.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring presents two supported translation methods, including a 'direct' mode that overlays translated text on the original PDF. However, the corresponding implementation only iterates extracted words and then does nothing before printing that the direct method is not fully implemented, so the documentation materially overstates what the code does.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/pdf_translate.py (reported line 77)May include surrounding context.
python
# Convert DOCX to PDF (requires LibreOffice) try: result = subprocess.run( ['soffice', '--headless', '--convert-to', 'pdf', '--outdir', Path(output_path).parent, str(tmp_docx)], capture_output=True, text=True, timeout=120

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The direct_method docstring explicitly states 'modifies PDF in place', which contradicts the function body. The code only reads the PDF with pdfplumber, contains a pass where translation/write logic would be, and ends by telling the user the method is not fully implemented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The translation mapping replaces English terms with Chinese strings, and the file description says it translates to a target language, but the script does not let the user choose the target language. This creates a natural-language locale policy issue because it effectively forces a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The usage string presents --tgt-lang zh as the default behavior, which steers the skill toward a specific language/locale by default. The file does not offer an interactive choice or justify why Chinese is the mandatory default, so this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest says the skill supports PPT/Word/PDF/Excel translation from English to Chinese or any language, but this script only returns a hard-coded mapping when src_lang is 'en' and tgt_lang is 'zh'. For any other language pair, it returns an empty translation list, so the advertised broader translation capability is not actually implemented here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The command-line parser sets --tgt-lang to zh by default, forcing a specific output language unless the user overrides it. Because the skill does not provide explicit opt-in or document a justified region-specific constraint, this violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and CLI imply that the script translates English text in XLSX to a target language, with configurable source and target languages. In reality, load_translations returns only a fixed list of English-to-Chinese replacements and returns an empty list for any other language pair, so the implemented behavior is far narrower than the described translation capability.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The code traverses and rewrites all XML text nodes in worksheet XML, not just user-facing shared strings. That can alter formula text, metadata, or structured worksheet content inside the XLSX package, leading to silent document corruption or semantic changes while falsely claiming formulas and formatting are preserved.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The docstring for translate_file states it translates a PPTX file 'in-place', which implies modifying the original file. The code instead derives a new output path with a language suffix unless an explicit output path is provided, so the documentation contradicts the actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The usage text presents --tgt-lang zh as the default target language, and the script implementation also defaults tgt_lang='zh'. This imposes a specific locale/language behavior unless the user overrides it, which is a natural-language locale policy concern when no opt-in or choice is surfaced first.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The command-line interface defines --tgt-lang with a default of zh, which bakes in a specific language preference. Because the skill does not ask for explicit user opt-in before applying that locale choice, this can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.