sum_and_translate_install_check

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 1:23 PM UTC
• Version: 1.1.0

Overview

This skill is a disclosed environment checker and optional installer for a PDF summarization and translation pipeline, with no evidence of hidden exfiltration, persistence, or destructive behavior.

Install this only if you want it to modify the active Python environment for a PDF OCR/summarization/translation workflow. Prefer running it in a virtual environment because --install downloads many packages and Chromium, and be aware that the import check calls python-dotenv, which may load a local .env file into the script process.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

exec() call detected

High

• Category: Dangerous Code Execution

Content

failed = []
    for label, code in CHECKS:
        try:
            exec(code, {})
        except Exception as exc:
            print(f"FAIL {label}: {type(exc).__name__}: {exc}", flush=True)
            failed.append(label)

• Confidence: 85% confidence
• Finding: Direct exec() call allows arbitrary code execution. An attacker can inject code that runs with the full privileges of the process.

exec() call detected

High

• Category: Dangerous Code Execution

Content

failed = []
    for label, code in CHECKS:
        try:
            exec(code, {})
        except Exception as exc:
            print(f"FAIL {label}: {type(exc).__name__}: {exc}", flush=True)
            failed.append(label)

• Confidence: 85% confidence
• Finding: Direct exec() call allows arbitrary code execution. An attacker can inject code that runs with the full privileges of the process.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill is an executable script that can inspect the environment and perform package installation, but the metadata declares no explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can allow broader shell/environment access than reviewers or orchestrators expect, increasing the risk of unintended command execution or dependency changes.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill description and usage conditions are written entirely in Russian and implicitly prescribe Russian as the operating language. The policy specifically calls for flagging language or locale constraints when the skill does not offer the user a language/locale choice or clearly justify the restriction.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This is a code file, so SQP-3 applies to natural-language content in docstrings and strings. The file presents instructions and operational output in Russian only, and there is no indication that the skill is region-specific or that users can opt into another language, which violates the language/locale policy criteria.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(cmd, what):
    """Запустить подпроцесс, вернуть True/False и напечатать понятный итог."""
    try:
        proc = subprocess.run(cmd)
    except (OSError, subprocess.SubprocessError) as exc:
        print(f"FAIL {what}: не удалось запустить — {exc}", flush=True)
        return False

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.