Security audit
Security checks for vulnerabilities and agentic risk
This documentation-only skill explains a translation CLI with expected provider, credential, config, and file overwrite features, with some privacy and overwrite cautions users should keep in mind.
Before installing or using this skill, treat it as a guide for a CLI that may send translated text or file contents to configured providers. Use trusted providers for sensitive documents, protect API keys, avoid putting secrets directly on command lines when possible, and be careful with --in-place or --yes because they can overwrite files without an interactive prompt.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
translate --provider ollama --model llama3.2 --text --to fr "Hello world"
This markdown file documents multiple providers with api_key settings and remote base_url endpoints, which implies credentials may be stored in config and user content may be sent to third-party services. The document does not include any warning about protecting secrets, avoiding committing config files, or the privacy implications of using remote providers.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- `--suffix <SUFFIX>`: output filename suffix for per-file output naming.
- `--stream`: force streaming on for this command (stdout only).
- `--no-stream`: force streaming off for this command.
- `-y, --yes`: skip confirmations.
- `-j, --jobs <N>`: parallel file translations.
## Language flags
The documentation explicitly supports external provider selection, base URL overrides, and direct API key injection, but it does not warn users that input text may be transmitted to third-party services or that command-line API keys can be exposed through shell history, process listings, and logs. In a translation CLI context, users may translate sensitive files, so the omission can lead to unintended disclosure of confidential content and credentials.
The quickstart prominently encourages use of network-backed providers and shows API key setup, but it does not clearly warn that inline text, stdin, and file contents may be transmitted to third-party services. In a translation CLI context, users may reasonably process sensitive documents, so omission of a privacy/data-handling warning can lead to unintended disclosure.
The in-place example demonstrates destructive modification of the source file with --in-place --yes but does not warn that the original content will be overwritten. In quickstart documentation, copy-pasteable destructive commands can cause accidental data loss, especially when users are experimenting on important files.
The sample defaults specify to = "en", which can be read as enforcing English as the default output language. Because the documentation does not mention that users can or should choose their preferred target language, this may conflict with language/locale choice expectations.
This markdown file lists sensitive credential environment variables such as OPENAI_API_KEY, ANTHROPIC_API_KEY, and DEEPL_API_KEY, but does not include any caution about protecting secrets or avoiding accidental exposure. For markdown files, SQP-2 applies when descriptions omit warnings about behavior that could affect user privacy or security.
No suspicious patterns detected.