Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent PDF translation wrapper, with the main user-visible risk being that document text may go to configured translation providers.
Before installing, confirm you are comfortable with pdf2zh-next handling the selected PDFs and with any configured cloud provider receiving document text. For sensitive PDFs, choose a local or trusted provider, review config.toml first, and avoid passing an untrusted --exe-path.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
"LANG",
"LC_ALL",
}
env = {k: v for k, v in os.environ.items() if k in keep_keys}
isolated_home = str(SKILL_DIR)
env["HOME"] = isolated_home
The skill advertises shell and environment-dependent behavior but does not declare any explicit tool scope or permissions boundary. In an agent setting, this creates ambiguity about what commands may be executed and what environment data may be exposed, increasing the chance of over-broad shell access or accidental use of sensitive context.
The skill documents subprocess execution and acknowledges possible upstream downloads, but it does not clearly require an explicit user warning or consent before those behaviors occur. In practice, running the wrapper may trigger code execution and network activity beyond a user's expectation, which can affect privacy, reproducibility, and supply-chain exposure.
The skill instructs the agent to consult an external website for parameter guidance, which expands the trust boundary from a local wrapper to live remote content. This can introduce prompt injection, content tampering, or unintended network access, especially because the website's content is outside the audited skill package.
The config hard-codes lang_out = "zh-CN", which enforces a specific output locale. Under the policy, locale restrictions should offer user choice or be clearly documented and justified as region-specific; this file provides neither.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
[siliconflow_detail]
translate_engine_type = "SiliconFlow"
support_llm = "yes"
siliconflow_base_url = "https://api.siliconflow.cn/v1"
siliconflow_model = "Qwen/Qwen2.5-7B-Instruct"
siliconflow_api_key = "null"
siliconflow_enable_thinking = false
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
[siliconflow_detail]
translate_engine_type = "SiliconFlow"
support_llm = "yes"
siliconflow_base_url = "https://api.siliconflow.cn/v1"
siliconflow_model = "Qwen/Qwen2.5-7B-Instruct"
siliconflow_api_key = "null"
siliconflow_enable_thinking = false
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def read_cli_help_text(base_cmd: list[str]) -> str:
cp = subprocess.run([*base_cmd, "-h"], text=True, capture_output=True, check=False, env=_isolated_env())
return (cp.stdout or "") + "\n" + (cp.stderr or "")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if visible_window:
# Windows native console window for realtime monitoring.
flags = getattr(subprocess, "CREATE_NEW_CONSOLE", 0)
proc = subprocess.Popen(cmd, env=env, creationflags=flags)
rc = proc.wait()
return rc == 0, f"exit={rc}"
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return rc == 0, f"exit={rc}"
if stream:
proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, bufsize=1, env=env)
lines: list[str] = []
assert proc.stdout is not None
for line in proc.stdout:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
rc = proc.wait()
return rc == 0, "\n".join(lines[-40:])
cp = subprocess.run(cmd, text=True, capture_output=True, env=env)
tail = (cp.stdout + "\n" + cp.stderr)[-2000:]
return cp.returncode == 0, tail
The help section directs the agent to use a Chinese-language official reference document (/zh/advanced/advanced.html) with no indication that language can be chosen based on user preference. This can violate language/locale policy when a skill implicitly forces a specific language without opt-in.
The setting ui_lang = "en" fixes the interface language to English, and the file does not indicate any user opt-in or documented justification for that locale constraint. This can violate language/locale policy when users are not given a choice.
No suspicious patterns detected.