Security audit

Medical Translation

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a limited medical-term translation helper with overstated scope, but no hidden access, persistence, network use, or destructive behavior was found.

Install only if you want a very small, local Chinese-English medical terminology lookup and audit demo. Do not treat it as professional medical translation, paragraph translation, or broad academic-writing support without manually reviewing outputs and narrowing the documented scope.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code’s core function is a limited dictionary-based translator for a small set of medical terms, primarily between English and Chinese. It does not implement an academic writing workflow, explicit assumption handling, or notable execution-boundary controls beyond returning a basic result dict. There are no undeclared dangerous capabilities or resource accesses, but the declared purpose overstates the breadth and workflow sophistication of the implementation. Therefore, the description does not accurately represent what the code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is translation-related, specifically medical translation in academic writing workflows. The actual code does not perform translation, language processing, or workflow execution for medical content. Instead, it validates the presence of SKILL.md and scripts/main.py and emits a diagnostic JSON payload for audit/smoke-test purposes. While the payload contains translation-themed labels, the functional behavior is repository validation, which is a materially different primary purpose from the declared description.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The label invites use of the skill for generic academic writing tasks rather than tightly scoping it to medical translation. In an agent setting, broad invocation phrasing can cause the skill to trigger outside its intended domain, increasing the chance of scope drift, unsafe content transformation, or misuse of medically framed workflows for unrelated writing tasks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a medical translation skill for academic writing workflows, and the module docstring further suggests support for Chinese-English, Chinese-Spanish, and other medical terms. In reality, the implementation only handles Chinese↔English lookups from a small hard-coded dictionary and explicitly marks other language pairs as unsupported.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The top-level documentation says the script supports Chinese-English, Chinese-Spanish, and other medical term translations. However, the branch at L42-L52 only implements Chinese↔English behavior and returns a not-supported message for all other language pairs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill encourages users to run local Python scripts, but the warning about code execution and workspace writes is only implicit in a generic risk table. That increases the chance that users execute packaged code without understanding that it may modify local files, which is especially relevant for skills distributed as documentation-driven workflows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.