IBCAT - International Bilingual Chinese Advanced Translator

• Outcome: Review
• Latest audit: Jul 22, 2026 · 8:37 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform PDF translation as advertised, but it should be reviewed because it persistently patches BabelDOC security checks and stores/deletes document work files without strong safeguards.

Review before installing. Use this only in a disposable virtual environment or container, avoid running it as root or in a shared Python installation, and do not process confidential PDFs unless you are comfortable with extracted text being saved in the work directory and used for LLM translation. Back up or isolate the BabelDOC cache and choose a dedicated work directory before running the cleanup scripts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs users to patch BabelDOC source code to bypass font and CMap hash verification. Disabling integrity checks defeats the trust boundary for downloaded or cached assets and can allow tampered fonts/CMaps or compromised local cache contents to be accepted, increasing the risk of malicious asset loading or unsafe downstream parsing behavior.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The docstring presents the script as simple font setup, but the code also patches an installed BabelDOC package to bypass font and CMap hash verification. That mismatch is security-relevant because it conceals behavior that disables integrity protections, increasing the chance an operator will run the script without understanding that trusted-package verification is being removed.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The replacement function claims only to avoid network calls, but it also hardcodes the upstream selection to "github" and returns dummy metadata. Misleading patch documentation makes it easier to hide functional and trust-boundary changes, and can interfere with expected fallback or validation behavior in upstream-selection logic.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly states that extracted PDF text segments are sent through a translation proxy/LLM, but it does not clearly warn users that document contents may leave the local machine and be exposed to third-party services. In a document-translation skill, PDFs may contain confidential business, legal, or personal data, so omission of a privacy/data-egress warning can lead to unintended disclosure.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The README instructs users to run a cache-deletion command but does not clearly label it as a destructive operation or explain its consequences. While limited in scope, silent deletion can cause loss of cached work, confusion, or accidental disruption if copied into automation without understanding.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger conditions are very broad and activate on generic PDF translation requests and common keywords, which can cause the skill to run in contexts the user did not specifically intend. In this skill, broad activation is more concerning because execution may lead users into workflows involving local services, patching third-party code, and sending document contents through a translation pipeline.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description explains that text is routed through a local OpenAI-compatible HTTP proxy and LLM translation pipeline, but it does not clearly warn users that document contents are extracted and transmitted to another service boundary. For sensitive PDFs, this can cause unintentional disclosure of confidential or regulated content.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The workflow includes destructive cleanup commands that delete cache and working data, but the skill does not prominently warn users about the deletion behavior or scope. While the shown paths are specific, automated execution without notice can still erase prior work products, forensic artifacts, or cached state that a user expected to retain.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: In translate mode, unknown user-provided text segments are written to UNKNOWN_FILE, and in extract mode submitted text is persisted to SEGMENTS_FILE. This creates a real privacy/security issue because translation inputs may contain sensitive document content, credentials, personal data, or proprietary text, and the server stores that content on disk without any access control, retention policy, minimization, or user warning.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The script overwrites an installed package file in site-packages without prompting, backup, or integrity safeguard. Silent in-place modification of dependency code is dangerous because it can break future updates, undermine provenance guarantees, and leave users unaware that security checks were disabled in a shared runtime.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Step 2: Clear old caches
echo "[Step 2] Clearing old caches..."
rm -f /root/.cache/babeldoc/cache.v1.db
mkdir -p "$WORK_DIR"
rm -f "$WORK_DIR/segments.json" "$WORK_DIR/translations.json" "$WORK_DIR/unknown_segments.json"

• Confidence: 82% confidence
• Finding: The script unconditionally deletes a cache file under /root, assuming privileged execution context and modifying global state outside the job's isolated workspace. In a shared or sensitive environment, this can destroy unrelated cached data, disrupt concurrent jobs, and normalize unsafe filesystem side effects from a translation helper script.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "[Step 2] Clearing old caches..."
rm -f /root/.cache/babeldoc/cache.v1.db
mkdir -p "$WORK_DIR"
rm -f "$WORK_DIR/segments.json" "$WORK_DIR/translations.json" "$WORK_DIR/unknown_segments.json"

# Step 3: Kill any existing proxy on the port
kill $(lsof -ti:$PROXY_PORT 2>/dev/null) 2>/dev/null || true

• Confidence: 90% confidence
• Finding: The script deletes files under a user-controlled WORK_DIR without validating that the path is safe, expected, or confined to an application-owned workspace. If WORK_DIR is pointed at an unexpected location or a symlinked path, the cleanup step can remove unrelated files and cause data loss before any translation work starts.

Static analysis

No suspicious patterns detected.