research-paper-pdf-translator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:37 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent PDF translation purpose, but it exposes raw PDF text directly to the agent and uses unsafe temporary-file handling.

Review before installing. Use this only on PDFs and directories you trust, avoid sensitive or proprietary papers unless you are comfortable with their full text entering the agent context, and do not run it in shared writable directories or with elevated privileges.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.py:21
• Finding: Untrusted PDF Content Can Hijack Agent Instructions## Vulnerability Details **File Location**: `SKILL.py`, lines 21-24 **Vulnerability Type**: Prompt injection through attacker-controlled document content **Risk Level**: High ### Complete Code Snippet ```python with open(txt_path, "r", encoding="utf-8") as f: paper_content = f.read() # Print the extracted content and a prompt for the agent to continue print(f"---BEGIN_PAPER_TEXT---\n{paper_content}\n---END_PAPER_TEXT---") print(f"Agent, please translate and summarize the above text into a markdown file, following the specified format and highlighting bioinformatics details. The original PDF was located at: {pdf_path}. Please save the resulting markdown file in the same directory.") ``` ### Technical Analysis The text extracted from the supplied PDF is attacker-controlled and is printed verbatim into an agent-facing instruction stream. The delimiters do not provide a security boundary because an attacker can include strings such as `---END_PAPER_TEXT---` within the PDF itself. A malicious PDF can therefore contain forged instructions that appear after a counterfeit closing delimiter. No structured separation, escaping, content encoding, or explicit instruction tells the downstream agent to treat all extracted content exclusively as untrusted data. Although the Python process does not directly execute instructions embedded in the PDF, the skill is specifically designed to have an agent consume its output and continue acting on it. Consequently, document content can influence later agent behavior. ### Attack Path 1. An attacker creates a PDF containing ordinary scientific text followed by a forged `---END_PAPER_TEXT---` delimiter. 2. The attacker adds instructions requesting behavior unrelated to translation, such as reading local files, changing the output destination, disclosing secrets, or invoking tools. 3. A user invokes the skill with the malicious PDF. 4. `pdftotext` extracts both the visible document co ...[truncated 961 chars]
• Remediation: ## Remediation Suggestions 1. Pass extracted document text through a structured data field rather than concatenating it into an instruction stream. 2. Explicitly instruct the downstream agent that all PDF content is untrusted data and that instructions, tool requests, delimiters, or role declarations found in it must never be followed. 3. Encode the document content, such as with JSON serialization, and parse it only as document data. 4. Do not rely on static plaintext delimiters as a security boundary. If delimiters remain necessary, generate unpredictable delimiters and still treat all enclosed content as untrusted. 5. Restrict the downstream agent to the minimum tools required for translation. It should not have unrestricted shell, network, credential, or filesystem access. 6. Validate and constrain the output location in application code rather than allowing document content or generated responses to select it. 7. Consider processing the document in a sandbox and requiring user confirmation before executing any tool action suggested during document analysis.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.py:6
• Finding: Predictable Temporary File Permits Symlink and Race Attacks## Vulnerability Details **File Location**: `SKILL.py`, lines 6-28 **Vulnerability Type**: Insecure predictable temporary file handling **Risk Level**: Medium ### Complete Code Snippet ```python # Determine the directory of the PDF file pdf_dir = os.path.dirname(pdf_path) # Create a temporary text file in the same directory as the PDF txt_path = os.path.join(pdf_dir, "temp_paper_for_translation.txt") try: # Check if pdftotext is installed subprocess.run(["which", "pdftotext"], check=True, capture_output=True) except subprocess.CalledProcessError: print("Error: pdftotext command not found. Please install poppler-utils (e.g., sudo apt-get install -y poppler-utils).") sys.exit(1) try: subprocess.run(["pdftotext", pdf_path, txt_path], check=True, capture_output=True) except subprocess.CalledProcessError as e: print(f"Error converting PDF to text: {e.stderr.decode()}") sys.exit(1) with open(txt_path, "r", encoding="utf-8") as f: paper_content = f.read() # Print the extracted content and a prompt for the agent to continue print(f"---BEGIN_PAPER_TEXT---\n{paper_content}\n---END_PAPER_TEXT---") print(f"Agent, please translate and summarize the above text into a markdown file, following the specified format and highlighting bioinformatics details. The original PDF was located at: {pdf_path}. Please save the resulting markdown file in the same directory.") # Clean up temporary file os.remove(txt_path) ``` ### Technical Analysis The script uses the fixed filename `temp_paper_for_translation.txt` in the directory containing the user-supplied PDF. That directory may be writable by another local user or otherwise attacker-controlled. The temporary file is not created atomically with exclusive-create semantics. The code also does not verify whether the path is a symbolic link, regular file, or other filesystem object. The pathname is independently accessed by `pdftotext` ...[truncated 2515 chars]
• Remediation: ## Remediation Suggestions 1. Create temporary files with `tempfile.NamedTemporaryFile` or `tempfile.mkstemp` using an unpredictable name and restrictive permissions. 2. Prefer a trusted private temporary directory rather than the potentially attacker-controlled PDF directory. 3. Avoid closing and reopening a temporary file by pathname where possible. Retain the securely created file descriptor throughout processing. 4. If `pdftotext` requires an output pathname, create a private temporary directory with mode `0700` and place the output inside it. 5. Verify that the resulting object is a regular file owned by the expected user and reject symbolic links or unexpected filesystem object types. 6. Place cleanup in a `finally` block so temporary files and directories are removed on conversion, decoding, or output errors. 7. Use a distinct temporary location for every invocation to prevent collisions between concurrent executions. 8. Run document conversion with the least possible privileges and, where practical, inside a sandbox with restricted filesystem access.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The markdown states that the skill automatically translates English research PDFs into Chinese and frames the usage scenario around obtaining Chinese content, with no indication that the user can choose another language. This is a natural-language locale policy issue because it imposes a specific language by default rather than offering an explicit opt-in or language selection.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The documentation states the skill translates and reorganizes research-paper PDFs, but it also requires and therefore likely executes the external `pdftotext` program. Spawning external binaries is a distinct capability that is not explicitly justified or declared beyond the high-level translation purpose, and can materially expand operational risk compared with a purely in-process document parser.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # Check if pdftotext is installed
        subprocess.run(["which", "pdftotext"], check=True, capture_output=True)
    except subprocess.CalledProcessError:
        print("Error: pdftotext command not found. Please install poppler-utils (e.g., sudo apt-get install -y poppler-utils).")
        sys.exit(1)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Check if pdftotext is installed
        subprocess.run(["which", "pdftotext"], check=True, capture_output=True)
    except subprocess.CalledProcessError:
        print("Error: pdftotext command not found. Please install poppler-utils (e.g., sudo apt-get install -y poppler-utils).")
        sys.exit(1)

    try:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.exit(1)

    try:
        subprocess.run(["pdftotext", pdf_path, txt_path], check=True, capture_output=True)
    except subprocess.CalledProcessError as e:
        print(f"Error converting PDF to text: {e.stderr.decode()}")
        sys.exit(1)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill prints the full extracted PDF text to stdout, which can disclose sensitive document contents into agent logs, console history, telemetry pipelines, or downstream tools without warning or consent. In an agent skill context this is more dangerous because stdout is often captured and forwarded, so private research papers or proprietary PDFs may be unintentionally exposed outside the user's intended destination.

Static analysis

No suspicious patterns detected.