PDF Master Translator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:39 AM UTC
• Version: 1.0.0

Overview

This PDF translator is not clearly malicious, but it needs Review because it sends document content to external AI/rendering services and renders untrusted model output with broad local/network access.

Install only after reviewing the data-flow risks. Do not use this skill on confidential, export-controlled, customer, military, or proprietary PDFs unless sending page images/text to Google GenAI and formulas to math.vercel.app is approved. Run it in a low-privilege sandbox with restricted outbound network access, and patch the renderer to sanitize model output and restrict WeasyPrint resource fetching before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/translator_engine_v10.py:130

Finding

Untrusted Model-Generated HTML Is Processed by a Network-Capable PDF Renderer

Content

View full analysis

[ Original Figures/Diagrams ]

" for b64 in fig_b64s: fig_html += f"

" fig_html += "" app_html = "" if annotations: app_html = f"

[ Diagram Symbol Description ]

{markdown2.markdown(annotations)}

" ``` The generated HTML is subsequently passed to WeasyPrint: ```python def build_pdf(html_segments, out_pdf): css = """...""" html = f"{css}{''.join(html_segments)}" html = final_sanitizer(html) HTML(string=html, base_url=os.getcwd()).write_pdf(out_pdf) ``` The same data flow exists in the other affected translator versions: Gemini output is converted through `markdown2.markdown()` and then supplied to `HTML(...).write_pdf()`. ### Technical Analysis PDF page images and extracted diagrams are uploaded to Gemini, whose response is treated as Mar ...[truncated 3663 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (61)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

A claimed robust multi-agent, zero-loss reconstruction pipeline that actually performs approximate reflow and limited heuristics can materially mislead users about trustworthiness and review requirements. In this context, the exaggerated description increases the likelihood of misuse on sensitive or accuracy-critical source documents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

A claimed robust multi-agent, zero-loss reconstruction pipeline that actually performs approximate reflow and limited heuristics can materially mislead users about trustworthiness and review requirements. In this context, the exaggerated description increases the likelihood of misuse on sensitive or accuracy-critical source documents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

A claimed robust multi-agent, zero-loss reconstruction pipeline that actually performs approximate reflow and limited heuristics can materially mislead users about trustworthiness and review requirements. In this context, the exaggerated description increases the likelihood of misuse on sensitive or accuracy-critical source documents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

A claimed robust multi-agent, zero-loss reconstruction pipeline that actually performs approximate reflow and limited heuristics can materially mislead users about trustworthiness and review requirements. In this context, the exaggerated description increases the likelihood of misuse on sensitive or accuracy-critical source documents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A claimed robust multi-agent, zero-loss reconstruction pipeline that actually performs approximate reflow and limited heuristics can materially mislead users about trustworthiness and review requirements. In this context, the exaggerated description increases the likelihood of misuse on sensitive or accuracy-critical source documents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A claimed robust multi-agent, zero-loss reconstruction pipeline that actually performs approximate reflow and limited heuristics can materially mislead users about trustworthiness and review requirements. In this context, the exaggerated description increases the likelihood of misuse on sensitive or accuracy-critical source documents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A claimed robust multi-agent, zero-loss reconstruction pipeline that actually performs approximate reflow and limited heuristics can materially mislead users about trustworthiness and review requirements. In this context, the exaggerated description increases the likelihood of misuse on sensitive or accuracy-critical source documents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A claimed robust multi-agent, zero-loss reconstruction pipeline that actually performs approximate reflow and limited heuristics can materially mislead users about trustworthiness and review requirements. In this context, the exaggerated description increases the likelihood of misuse on sensitive or accuracy-critical source documents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

A claimed robust multi-agent, zero-loss reconstruction pipeline that actually performs approximate reflow and limited heuristics can materially mislead users about trustworthiness and review requirements. In this context, the exaggerated description increases the likelihood of misuse on sensitive or accuracy-critical source documents.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises executable behavior that uses environment variables and external network access, but it declares no corresponding tool scope or permissions. This creates a covert capability gap: users and policy systems are not clearly informed that sensitive document content and API credentials may be used and transmitted externally.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- To prevent the translation Agent from producing out-of-context or broken translations, the pipeline injects the **raw, unformatted text stream** of the entire page as a reference dictionary. The Agent uses this context to seamlessly bridge the visual gaps.

3. **Protocol Downgrade (XML over JSON):**
   - Forcing LLMs to output thousands of words of Markdown inside a strict JSON structure is fragile and prone to escaping errors.
   - The engine enforces simple XML tags (`<HEADER>`, `<BODY>`, `<FOOTER>`) for structural routing.

4. **Strict Math & Symbol Rendering:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The usage instructions tell users how to run the translator but do not warn that document content is sent to external translation and math-rendering services. For engineering, scientific, or military PDFs, this omission can cause unintentional disclosure of confidential or regulated information to third parties.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

**Important Operational Rules:**
- Always specify `--start` and `--end` explicitly.
- For very large documents (>20 pages), it is highly recommended to run this using `nohup ... &` in the background, as the multi-agent cross-checking and API rate-limiting sleep cycles make this a long-running process.

## Output

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented output includes fixed Chinese headings ([ 原文图表/示意图 ] and [ 图例符号说明 ]) with no indication that the user can choose the output language or locale. This creates a language/locale policy concern because the skill appears to impose a specific language in generated output regardless of user preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt text hard-codes Chinese-language instructions for the layout analysis step, which imposes a specific language on the model output. The file does not offer a user opt-in, language selection, or documented justification for restricting the skill to Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The translation agent prompt is written to require Chinese output and behavior, including strict instruction text in Chinese, but there is no indication that the user selected this locale. This is a natural-language policy concern because the skill enforces a language choice rather than offering one.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code converts LaTeX formulas into image URLs hosted at math.vercel.app by embedding each formula in a GET query string. In this skill's context, formulas may come from sensitive engineering, scientific, or military PDFs, so this leaks document content to an unrelated third-party service during PDF rendering and creates an external dependency that can track access or fail unpredictably.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The comment says formulas are rendered into vector SVG images, but the implementation only inserts remote links that point to an external service. This mismatch is security-relevant because operators may believe formulas are embedded locally while the generated HTML/PDF still causes external fetches, resulting in hidden data exfiltration and unreliable builds.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill renders LaTeX by embedding remote image URLs from math.vercel.app into the generated HTML/PDF workflow. This causes document-derived formula content to be sent to an unrelated third-party service, creating an undisclosed data egress path and introducing a dependency on external network retrieval during document processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code uploads full page images to Google's GenAI service for layout analysis without any user disclosure, consent flow, or sensitivity check. Because the skill is intended for engineering, scientific, and military-style PDFs, uploaded pages may contain proprietary, export-controlled, or otherwise sensitive information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill uploads extracted figure images to an external model for annotation without warning the user. Figures in technical PDFs often contain high-value schematics, labels, and operational details, so sending them to a third party materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The translation stage sends masked page images and prior-page text context to an external AI model without any user-facing notice or approval. This broadens the data exposure beyond a single page and may leak sensitive narrative, metadata, or controlled technical content to a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction 翻译为纯正中文。严禁出现中英夹杂。 forces a single language output regardless of user preference. This is a natural-language locale policy concern because the file provides no user choice or documented justification for restricting output to Chinese only.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest focuses on translating and reconstructing PDFs, but the implementation pulls a GEMINI_API_KEY from the process environment to access an external AI service. Accessing environment-based secrets is a broader capability than the manifest states and is not an obvious requirement unless remote model usage is explicitly declared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow uploads full page images, masked pages, and cropped tables/figures to an external AI provider for analysis and translation. Given the skill is explicitly intended for complex engineering, scientific, or military PDFs, this creates a significant confidentiality and data-governance risk if users are not clearly warned and given a choice.

Content

No source excerpt is available for this finding.