Release Note Localizer

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:08 AM UTC
• Version: 1.0.0

Overview

The skill claims to localize release notes, but its bundled script mainly restructures input and contains under-disclosed local audit/scanning code, with no evidence of exfiltration or persistence.

Review this before installing if you expected a pure translator. Use it only with non-sensitive release-note material, avoid pointing the script at broad local directories, and treat the bundled Python script as a local report/audit helper rather than a reliable localization engine.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是发布说明翻译与多版本改写工具，但代码实际实现的是通用审计/扫描器。脚本会读取本地文件、目录、CSV 和 Skill 工程目录，统计扩展名、抽取 Markdown 标题、检查必需文件、解析 frontmatter，并扫描诸如 curl|bash、rm -rf、base64 执行、secret/token/private URL 等模式。这些能力与“将发布说明转换为中文、英文、客户版和技术版”没有直接对应关系。代码中也看不到任何翻译引擎、术语库、一致性检查、语言检测、语言转换或面向客户/技术受众的文本重写逻辑。因此该技能的实际主要用途与声明严重不符。

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The core report generator transforms arbitrary input into a fixed Chinese review/report structure instead of performing the claimed multilingual release-note translation. While not directly code-executing, this is a security-relevant integrity issue because the skill is materially deceptive about what it does, which can cause sensitive content to be processed and reformatted unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script includes regex-based scanning for secrets, private URLs, and dangerous shell patterns, functionality unrelated to release-note localization. In the context of a translation skill, embedding local content inspection logic is risky because it can be used to probe arbitrary files/directories and surface snippets of sensitive material in generated reports.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s dispatcher supports directory auditing, CSV auditing, pattern scanning, and skill-package auditing rather than the declared release-note localization workflow. This capability mismatch is dangerous because users may run the skill on local directories expecting translation behavior, but the code instead inventories files and inspects unrelated content, increasing unintended access to local data and violating least surprise.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger section lists natural-language examples like “把发布说明改成中文和客户版” and “统一术语并重写语气” without defining explicit boundaries, required context, or negative examples. This makes activation scope ambiguous and risks matching ordinary editing or translation requests beyond the intended release-notes use case.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises or implies code-capable behavior, including shell execution and file I/O, but does not declare any explicit tool scope such as permissions or allowed-tools. This creates a governance gap: a caller or platform may not correctly constrain execution, increasing the chance of unexpected local file access or command execution beyond the user’s intent.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The manifest description states the skill converts release notes into Chinese and English variants, and the document consistently frames outputs as Chinese/English deliverables. This imposes a language choice by default without indicating user selection or opt-in, which conflicts with the policy against forced language or locale constraints.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The required output template includes fixed sections for '中文版本' and '英文版本', which directs the skill to produce specific languages even when the user may not have requested them. This is a natural-language policy issue because it hard-codes language behavior instead of allowing user choice.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The manifest states that the skill converts release notes into Chinese, English, customer, and technical versions as a built-in behavior. This imposes specific language outputs by default, and the file does not indicate that users can choose languages or opt in to locale constraints, which may violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The generated report strings in make_structured_report are hard-coded in Chinese, which enforces a specific language for user-facing output. The file does not provide any option for users to choose language or document a justified locale restriction, matching the policy-violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: directory_report emits headings and guidance entirely in Chinese, again imposing a fixed locale in user-visible output. Because no user opt-in, configuration, or justification is present, this is a natural-language locale policy issue.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The csv_report function produces Chinese-only section labels and explanatory text, and similar Chinese-only messages appear in parse_frontmatter/skill_audit. This consistently forces one language across user-facing results without opt-in or a documented regional limitation.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code audits skill-package structure and parses SKILL.md frontmatter, which is outside the declared localization use case. This broadens the tool’s data access and creates a misleading capability surface, allowing inspection of repository contents under the guise of translation assistance.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The CLI presents itself as a generic support script for the skill, but the implementation is actually a multi-mode audit/report generator unrelated to the published purpose. Misleading interfaces are dangerous in agent/tooling contexts because they erode trust boundaries and can induce operators to provide broader filesystem inputs than necessary.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This file forces a specific language for readers and operators of the skill test procedure, which can violate a language/locale policy when no opt-in or alternative language is provided. The content does not indicate that the skill is region-specific or that Chinese is a required locale.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The README states that the skill converts release notes into Chinese, English, customer-facing, and technical versions, which implies fixed language behavior. There is no accompanying language-choice or opt-in language to clarify that output locale should follow user preference.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The example output is entirely structured around Chinese headings such as "中文版本" and the title is in Chinese, which suggests a fixed language/locale expectation. There is no natural-language indication that the user can choose another language or locale, so this may violate the language/locale choice policy.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The template headings and instructions are all in Chinese, and the file does not indicate that use of Chinese is optional or limited to a region-specific workflow. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.