Translink CLI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:36 PM UTC
• Version: 1.0.1

Overview

This is a coherent Translink transit-data helper, with a disclosed but externally supplied CLI dependency users should verify before use.

Before installing, verify the external Translink CLI source and prefer a known commit or release rather than any translink_* executable found in PATH. Treat the skill itself as a transit-data helper, but remember its real runtime behavior depends on the separately installed CLI implementation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned and Unverifiable External CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–17
Vulnerability Type: Untrusted and mutable third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

This skill requires the Translink CLI scripts to be installed and available in PATH.

- CLI repo: `https://github.com/alanburchill/traslink-cli-scripts`
- Expected commands: `translink_*` (or equivalent wrappers that expose the same command names)

If the CLI is not installed, stop and ask the user to install it first.

Technical Analysis

The Skill delegates its operational behavior to code outside the audited package. The dependency is hosted in a personal GitHub repository and is not pinned to an immutable commit, signed release, version, or integrity hash. The repository path also uses traslink rather than translink, which may be intentional but creates ambiguity and potential typosquatting risk.

The instruction additionally permits unspecified “equivalent wrappers” based only on matching command names. An executable named translink_* found earlier in PATH could therefore be accepted without validating its origin or integrity. Because the external implementation is absent from the project, its network access, filesystem behavior, command construction, and update process could not be audited.

This finding does not establish that the referenced repository is malicious. It identifies an unsafe supply-chain trust boundary that could allow the effective behavior to change after this Skill has been reviewed.

Attack Path

1. An attacker compromises the referenced repository, distributes a similarly named repository, or supplies an untrusted wrapper exposing the expected command names.
2. The user installs the mutable external code, or the malicious executable is placed earlier in PATH.
3. The Skill treats the executable as a legitimate Translink command because its name matches translink_*.
4. A normal schedule or realtime query invokes the substi ...[truncated 674 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed immutable commit SHA or cryptographically signed release rather than a mutable repository branch.
2. Publish an expected checksum or signature and verify it before installation or execution.
3. Confirm and document whether the traslink-cli-scripts spelling is intentional; correct it if it is an error.
4. Provide explicit installation instructions using the exact repository, version, and verification procedure.
5. Remove support for unspecified “equivalent wrappers,” or define an allowlist of approved executable paths and versions.
6. Resolve each executable to its canonical path and validate its provenance and integrity before invocation.
7. Prefer bundling the auditable implementation with the Skill when licensing and deployment constraints permit.
8. Run the CLI with least privilege and restrict its filesystem and network access where practical.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.