Translate Paper ZH

• Outcome: Pass
• Latest audit: Oct 2, 2026 · 7:38 AM UTC
• Version: 0.1.0

Overview

This is a coherent local workflow for translating academic papers into Chinese PDFs with QA helpers, not hidden or malicious behavior.

Install only if you intend to process full academic papers into Chinese and have rights to transform the document. Expect local PDF extraction, rendered page images, translation plans, QA reports, and output PDFs to be created. Use trusted dependency sources and avoid sending confidential manuscripts to external translation services unless separately authorized.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose promises end-to-end paper translation into a Chinese searchable PDF preserving scholarly layout. The supplied code instead acts as a fail-closed audit script: it opens an existing output PDF, extracts text/fonts/pages, verifies Chinese text extractability, checks font embedding, compares expected source units against a plan, validates translated/retained units, flags remaining English, renders page images for review hashing, and writes audit artifacts. It never translates source content, never constructs a new PDF, and never performs layout preservation itself. While its checks are related to translated-paper quality assurance, QA is a materially different primary purpose from translation/generation. Therefore the description does not accurately represent the actual code behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is end-to-end translation of academic papers into Chinese while preserving scholarly formatting. The supplied code does not translate text, detect language, create a Chinese edition, or manipulate scholarly structures such as equations, citations, footnotes, or appendices. Its sole function is optimizing an existing PDF by subsetting fonts and validating that the rendered output and extracted text remain identical. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose promises full-paper translation into a searchable Chinese PDF, implying an end-to-end translation capability that preserves the paper’s structure and content. The actual code does not translate text at all. Instead, it consumes an existing source PDF plus inventory and plan JSON files containing predesignated translated regions, validates those inputs, removes source text spans via redaction, and inserts the supplied target text into bounded boxes. The script also enforces non-overlap and readability constraints and preserves images/graphics by not redacting them. Its own docstring says it is a 'layout aid, not a translator or proof of completeness.' That is a materially different primary purpose from the declared description, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose promises an end-to-end paper translation workflow producing a searchable Chinese PDF closely matching the original academic layout. The supplied code instead performs a preparatory inventory step: it opens a PDF, checks encryption, extracts text blocks/spans and page-level counts, optionally renders page PNGs, and writes inventory.json plus a placeholder translation.json plan with pending statuses. There is no machine translation, no Chinese text generation, no PDF synthesis, and no fidelity-preserving reconstruction of the original paper. While inventorying could be a supporting component of a larger translation pipeline, this code chunk's actual primary behavior is materially different from the declared end-user function, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script’s behavior materially diverges from the advertised skill purpose: it inventories and raster-renders source PDFs, but does not perform translation or produce a Chinese PDF. In an agent setting, this kind of capability mismatch is dangerous because downstream automation may trust the manifest and handle sensitive copyrighted or private documents under false assumptions, leading to unintended data exposure, compliance issues, or failed workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The title, description, and example prompt all prescribe translation into Chinese, specifically Simplified Chinese, with no language-selection option or explicit statement that this locale is user-chosen. That can conflict with language/locale policy requirements because the skill appears to force a specific output language by default.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction says to infer Simplified Chinese unless the user requests otherwise, which imposes a language/locale default rather than eliciting an explicit user choice. The policy allows locale constraints only when the user is given a choice or the constraint is clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The display name, short description, and default prompt consistently require translating papers into Chinese, with no indication that users can select another language or opt in to this locale constraint. This is a natural-language locale policy concern because it hard-codes a specific language preference rather than offering a choice or documenting a justified regional limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest enables implicit invocation for a powerful document-processing skill without any visible trigger constraints, exclusions, or narrowing conditions. That increases the chance the system may auto-select this skill in contexts the user did not explicitly request, causing unintended upload, transformation, or disclosure of academic documents to a translation workflow.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/manifest.md (reported line 23)May include surrounding context.

md

## Text units

Each plan unit has `id`, `status` (`pending`, `translated`, `retained`), `kind`, `target`, `output_pages`, `fidelity_checked` and `reason`. Use positive integer output page numbers. For translated prose, `target` is the full Chinese text; the audit requires it in the searchable output after Unicode/whitespace normalization. If extraction order splits a paragraph around a formula or page break, split that unit into smaller traceable pieces in a deliberately revised inventory, or correct the output text layer; do not claim a match without checking it.

For retained content, the audit permits only `math`, `identifier`, `citation`, `reference`, `author` or `number` with a reason, and checks that source text survives. Do not relabel prose as a reference. Bibliographic identity retention does not permit retaining ordinary body prose, captions, footnotes or appendix paragraphs. Use translated prose plus the unchanged original identity within it when a block mixes those categories.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring explicitly states that no translation service is required, which directly contradicts the skill’s stated purpose of translating papers into Chinese PDFs. While not code execution by itself, this misleading declaration increases the risk that operators and orchestrators will misclassify the skill’s capabilities and send documents into an incomplete or noncompliant processing path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file describes translating full academic papers into searchable Chinese PDFs and using local helpers for reconstruction and optimization, which implies processing user documents and generating output files. It does not provide any explicit user warning about privacy considerations for unpublished manuscripts or that local files/PDF outputs will be created and modified during the workflow.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: PyMuPDF has 2 known advisory(ies) (CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py); CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency is only range-pinned (>=1.26.0,<2), so installs are not reproducible and may resolve to a vulnerable PyMuPDF release if an affected version falls within that range. In this skill’s context, the package is likely used to process untrusted PDFs, which increases the risk because a library flaw such as path traversal could be triggered during document-handling workflows.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: fonttools has 4 known advisory(ies) (CVE-2023-45139 (fonttools XML External Entity Injection (XXE) Vulnerability); CVE-2025-66034 (fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.v); CVE-2023-45139 (fonttools XML External Entity Injection (XXE) Vulnerability) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is not pinned to an exact version, so the environment may install a fonttools release affected by known issues such as XXE or arbitrary file write/XML injection. This skill translates full academic papers while preserving layout and fonts, so it plausibly processes complex document/font/XML-related inputs, making fonttools vulnerabilities more relevant and potentially exploitable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.