PDF文件高保真转换器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:08 AM UTC
• Version: 1.0.1

Overview

This PDF utility is mostly coherent, but its default PDF-to-PPT translation can send document text to external translation or LLM endpoints without clear user consent.

Review this skill carefully before installing, especially for confidential PDFs. Use --no-translate for PDF-to-PPT unless you explicitly want external or configured translation, and avoid opening generated spreadsheets from untrusted PDFs until formula injection is fixed or checked. Install in a dedicated virtual environment and prefer pinned dependency versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/translate_utils.py:125

Finding

Automatic Disclosure of PDF Text to External Translation Services

Content

View full analysis

MAX_TRANSLATE_BLOCKS: all_texts_flat = all_texts_flat[:MAX_TRANSLATE_BLOCKS] page_text_index = page_text_index[:MAX_TRANSLATE_BLOCKS] translated_flat = batch_translate( all_texts_flat, verbose=verbose_translate, ) ``` ```python # scripts/translate_utils.py:125-134 for engine in ['google', 'alibaba', 'baidu', 'youdao', 'bing']: try: result = ts.translate_text("test", to_language='zh', translator=engine) if result: _translators_engine = engine return engine except Exception: continue ``` ```python # scripts/translate_utils.py:168-175 result = ts.translate_text( protected_text, from_language=from_lang, to_language=to_lang, translator=engine, ) if result: result = _restore_terms(result, protected_map) return result ``` ```python # scripts/translate_utils.py:201-225 api_base = os.environ.get("OPENAI_API_BASE", "http://localhost:11434/v1") api_key = os.environ.get("OPENAI_API_KEY ...[truncated 3314 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pdf_to_xlsx.py:230

Finding

Spreadsheet Formula Injection Through PDF Table Content

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (32)

Tainted flow: 'api_base' from os.environ.get (line 201, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/translate_utils.py (reported line 213)May include surrounding context.

python

f"Return ONLY the translated text, no explanation.\n\n"
            f"Text: {text}"
        )
        resp = requests.post(
            f"{api_base}/chat/completions",
            headers={"Authorization": f"Bearer {api_key}"},
            json={

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This variant is security-relevant because it indicates undeclared external translation/API behavior and general text translation capabilities beyond the stated PDF-processing scope. Hidden or insufficiently disclosed networked translation can send document contents to third-party services, creating confidentiality and compliance risks for sensitive PDFs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This variant is security-relevant because it indicates undeclared external translation/API behavior and general text translation capabilities beyond the stated PDF-processing scope. Hidden or insufficiently disclosed networked translation can send document contents to third-party services, creating confidentiality and compliance risks for sensitive PDFs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This variant is security-relevant because it indicates undeclared external translation/API behavior and general text translation capabilities beyond the stated PDF-processing scope. Hidden or insufficiently disclosed networked translation can send document contents to third-party services, creating confidentiality and compliance risks for sensitive PDFs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This variant is security-relevant because it indicates undeclared external translation/API behavior and general text translation capabilities beyond the stated PDF-processing scope. Hidden or insufficiently disclosed networked translation can send document contents to third-party services, creating confidentiality and compliance risks for sensitive PDFs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This variant is security-relevant because it indicates undeclared external translation/API behavior and general text translation capabilities beyond the stated PDF-processing scope. Hidden or insufficiently disclosed networked translation can send document contents to third-party services, creating confidentiality and compliance risks for sensitive PDFs.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises automatic foreign-language PDF translation but does not warn users that document text may be transmitted to external services. For confidential, regulated, or personal documents, silent outbound transmission can result in data leakage, policy violations, and legal/compliance exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes or implies capabilities requiring shell, filesystem, environment, and network access, but it does not declare any tool scope or permission boundaries. In an agent setting, this increases the risk of over-privileged execution, unintended command/file access, and silent exfiltration via optional translation/network features.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger rules are intentionally broad and include loose paraphrases that can activate the skill from common PDF-related requests without precise user intent. In an agent ecosystem, this can cause over-invocation of a powerful file/network/shell-capable skill, increasing the chance of unintended file processing, data exposure, or unsafe workflow selection.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mcp_server.py (reported line 273)May include surrounding context.

python

}

    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code unconditionally invokes external conversion scripts via subprocess, and the advertised tools include operations that write output files and may modify PDFs. While the server internally returns results, there is no user-facing disclosure, confirmation, or warning in this file about those file-affecting operations before execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest explicitly says PDF content analysis/summary should use a different skill and that scanned-document OCR is out of scope. This code path converts every page to images and prints guidance for reviewing page contents and locating fields, which is a broader analysis-oriented capability than simple format conversion or direct form filling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script performs destructive PDF edits by default when not run with --detect-only, including removing XObject references and applying text redactions, but it does not require an explicit confirmation or present a clear warning about irreversible data loss and false positives. In this skill context, users are specifically asking to remove watermarks, so the behavior is expected, but silent destructive modification still creates a real safety risk because heuristic detection may delete legitimate page content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, CLI description, help text, and runtime messages are presented in Chinese only, which imposes a specific language on users. There is no opt-in, alternate locale, or documentation that this skill is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains natural-language docstrings, CLI help text, and runtime messages entirely in Chinese, which imposes a specific language on users. Under the policy, language constraints should be optional or clearly justified; no opt-in, alternate locale, or region-specific justification is provided here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic translation is enabled by default and the file interface does not clearly warn that extracted PDF text may be transmitted to a translation service. In a document-processing skill, users may reasonably expect local conversion only, so silent text exfiltration can expose confidential content and violate privacy or regulatory requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

For detected foreign-language PDFs, the tool automatically generates a Chinese-language version without offering a language choice or explicit consent. This increases the chance of unexpected disclosure, misprocessing, or policy violations, especially where only specific languages or no outbound processing are permitted.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The PDF-to-PPT feature performs automatic foreign-language detection and batch translation, which is outside the minimum scope of local document conversion and can cause extracted PDF text to be sent to a translation backend. If users provide sensitive PDFs, this creates an unannounced data egress path and increases privacy and compliance risk beyond what a converter would normally imply.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code file contains user-facing natural-language strings entirely in Chinese, including the module description and usage text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This module transmits document text to third-party translation engines even though the skill is primarily presented as a PDF conversion/processing tool. That creates a capability and data-flow mismatch: users may provide sensitive PDF content expecting local processing, while extracted text is sent off-box to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

User-supplied document text is sent to external translation services without any visible notice, consent gate, or policy check in this module. For a PDF utility, this is dangerous because users may not realize their document contents leave the local environment during translation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The LLM fallback posts extracted text to an OpenAI-compatible endpoint, extending the skill from document processing into networked data exfiltration of document contents. Because PDF text can contain confidential business or personal data, this fallback materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The fallback sends both document text and an authorization header to a configured HTTP API endpoint without any user disclosure or safety checks. This can leak sensitive document contents to remote infrastructure and, if misconfigured, expose API credentials to an unintended service.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The translation fallback sends the full input text directly inside a natural-language prompt and asks the model to return only translated text. If the input contains secrets, credentials, or private user-provided data, the model is explicitly instructed to reproduce that content in translated form, creating a semantic data-leak pathway even though no explicit exfiltration wording is used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt explicitly instructs the model to translate to Simplified Chinese, which is a language/locale constraint embedded in natural language. The file does not present this as a user opt-in or clearly justified region-specific limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.