Paper Translator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 0.1.2

Overview

The skill does translate PDFs as advertised, but its normal run path can automatically download and execute unverified external code and install unpinned tools on the user's machine.

Install only if you are comfortable with the skill downloading and running external installer code and installing an unpinned Python tool under your user account. Prefer manually installing reviewed, pinned dependencies first, run it on non-sensitive PDFs, choose a controlled output folder, and avoid copying private or copyrighted PDFs into QQBot upload storage unless you intend to share them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/translate_paper.sh:7

Finding

Unverified Remote Installer Is Piped Directly Into a Shell

Content

View full analysis

/dev/null || { echo "Installing uv..."; curl -Ls https://astral.sh/uv/install.sh | sh; } ``` ### Technical Analysis When `uv` is unavailable, the script retrieves mutable content from `https://astral.sh/uv/install.sh` and immediately passes it to `sh`. The downloaded content is not pinned to an audited version and is not verified using a checksum or cryptographic signature. HTTPS authenticates the connection under normal conditions, but it does not ensure that the server continues to return the same audited payload. Compromise of the hosting service, distribution infrastructure, DNS or certificate trust path, or the upstream installer could replace the response with arbitrary shell commands. Automatic execution of an external installer is not necessary for the Skill's core PDF translation operation. Dependency provisioning should be separated from normal document processing and require explicit user approval. ### Attack Path 1. A user invokes `translate_paper.sh` on a system where `uv` is not present in `PATH`. 2. The condition at line 7 automatically requests the current installer from the external URL. 3. An attacker who has compromised the upstream endpoint or relevant delivery infrastructure causes it to return modified shell code. 4. The pipeline sends the response directly to `sh`, without integrity verification or an inspection boundary. 5. The malicious response executes with all permissions available to the user who launched the Skill. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. This may permit access to that user's readable files, including the source PDF and local credentials; modification of user-owned files and configuration; execution of additional pa ...[truncated 316 chars]

Remediation

View remediation

/dev/null 2>&1; then echo "Error: uv is required. Install an approved, pinned version before running this script." >&2 exit 1 fi ``` ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/translate_paper.sh:8

Finding

Runtime Installation of an Unpinned Translation Package

Content

View full analysis

/dev/null || { echo "Installing pdf2zh-next..."; uv tool install pdf2zh-next; } ``` The installed executable is subsequently invoked at line 15: ```bash pdf2zh_next "$INPUT" --lang-in en --lang-out zh --qps 10 --pool-max-workers 100 "${@:2}" ``` ### Technical Analysis The command installs `pdf2zh-next` by package name without an exact version, lockfile, package hash, or signature verification. Consequently, the package version and transitive dependency graph can change after this Skill has been reviewed. The command relies on the package registry and its current resolution results. A compromised publisher account, registry compromise, malicious future release, or compromised transitive dependency could cause an unsafe package to be installed. The resulting `pdf2zh_next` executable is then run against a user-selected document. Although installation of a PDF translation engine supports the declared functionality, automatic installation of an unpinned dependency during ordinary execution exceeds the minimum necessary behavior. The Skill can instead require a preinstalled, audited dependency or use a reproducible, integrity-checked environment. ### Attack Path 1. An attacker compromises the `pdf2zh-next` release channel, publisher account, package registry entry, or one of its resolved dependencies. 2. The attacker publishes or substitutes a malicious version under the package name used by the script. 3. A user runs the Skill on a system where `pdf2zh_next` is not already available in `PATH`. 4. `uv tool install pdf2zh-next` resolves and installs the attacker-controlled or compromised package because no approved version or hash is enforced. 5. The script later invokes `pdf2zh_next`, allowing malicious package code to execute ...[truncated 673 chars]

Remediation

View remediation

/dev/null 2>&1; then echo "Error: the approved version of pdf2zh-next is not installed." >&2 exit 1 fi ``` The separate setup procedure should install an exact approved version with verified hashes, rather than using an unconstrained command such as `uv tool install pdf2zh-next`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The command pipes a remotely fetched shell script directly into sh, which executes untrusted code immediately with the user's privileges. This is a classic high-risk pattern because there is no opportunity to inspect the script, no integrity validation, and no restriction on what the fetched code may do.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The command chaining causes the remote installer to run automatically whenever uv is absent, with no pause, review, or confirmation step. This increases the likelihood of accidental execution of untrusted code and makes the dangerous action part of a normal success path rather than an explicit administrative action.

Content

Scanner excerpt · scripts/translate_paper.sh (reported line 7)May include surrounding context.

sh

[[ -z "$INPUT" ]] && { echo "Usage: $0 <input.pdf>"; exit 1; }
[[ ! -f "$INPUT" ]] && { echo "File not found: $INPUT"; exit 1; }

command -v uv &>/dev/null || { echo "Installing uv..."; curl -Ls https://astral.sh/uv/install.sh | sh; }
command -v pdf2zh_next &>/dev/null || { echo "Installing pdf2zh-next..."; uv tool install pdf2zh-next; }

# cd to input dir so pdf2zh_next outputs there

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The top-level description presents the skill as translating academic PDFs specifically from English to Chinese, and the named outputs are Chinese-only/bilingual artifacts. Although an argument later mentions --lang-out, the primary natural-language description fixes a specific locale without clearly offering user choice or explaining why the restriction is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states that it auto-installs uv and pdf2zh-next on first run, but does not warn users that executing the skill may modify their environment and fetch/install code from external sources. This is dangerous because users may run the one-liner expecting a pure local document transformation, while the script may perform network access and package installation with the user's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The QQBot instructions tell users to copy PDFs into another application's media upload directory and send them, but provide no privacy or data-handling warning. Because the skill processes academic PDFs and generated translations, this can lead to unintentional disclosure of sensitive or copyrighted documents to another app, its local storage, or downstream recipients.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script automatically installs missing tooling from the network at runtime, including an installer script and a Python tool, without pinning versions, verifying integrity, or requiring user approval. This creates a supply-chain and remote-code-execution risk because compromise of the upstream source or network path would lead to arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The command hard-codes "--lang-out zh", which imposes a specific language/locale choice on all users. There is no opt-in, prompt, or documented reason in this file that the skill must always translate to Chinese.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation lists generated output files in the same directory by default, but does not clearly warn that running the skill writes translated PDFs and a glossary CSV to disk alongside the source document unless --output is used. This can expose sensitive content through residual files, accidental syncing, or overwriting expectations in environments where users assumed ephemeral processing.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Fetching and executing an external script at runtime exposes the system to arbitrary code execution if the remote host, installer, or delivery path is compromised. In this skill context, the behavior is especially dangerous because it happens silently as part of a utility workflow, so users may not expect code from the internet to be executed.

Content

Scanner excerpt · scripts/translate_paper.sh (reported line 7)May include surrounding context.

sh

[[ -z "$INPUT" ]] && { echo "Usage: $0 <input.pdf>"; exit 1; }
[[ ! -f "$INPUT" ]] && { echo "File not found: $INPUT"; exit 1; }

command -v uv &>/dev/null || { echo "Installing uv..."; curl -Ls https://astral.sh/uv/install.sh | sh; }
command -v pdf2zh_next &>/dev/null || { echo "Installing pdf2zh-next..."; uv tool install pdf2zh-next; }

# cd to input dir so pdf2zh_next outputs there

Static analysis

No suspicious patterns detected.