Security audit

Baidu File Translate

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Baidu document translation helper with privacy and npm supply-chain caveats, but no hidden, destructive, or purpose-mismatched behavior in the artifact.

Install only if you are comfortable using Baidu's translation service for the documents you submit and exposing TRANS_API_KEY to the translation CLI. Avoid confidential, regulated, or highly sensitive files unless your policy allows Baidu processing, and prefer pinning or otherwise controlling the npm dependency in managed environments.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned npm Dependency Permits Unreviewed Package Updates
Content: View full analysis
Remediation: View remediation
" ``` 2. Verify package provenance and integrity using an npm lockfile, registry integrity metadata, signed provenance where available, or an equivalent trusted manifest. 3. Re-audit the package and its transitive dependencies before changing the pinned version. 4. Use a trusted, explicitly configured npm registry and enforce package allowlisting in controlled environments. 5. Disable npm lifecycle scripts during installation where compatible with the package: ```bash npm install --ignore-scripts ``` 6. Run installation and translation under a dedicated, least-privileged account or sandbox with access restricted to the intended input and output directories. 7. Expose `TRANS_API_KEY` only to the translation process when needed, and avoid making unrelated credentials available in the same environment. 8. Apply outbound network restrictions so the CLI can communicate only with documented translation-service endpoints. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill handles uploaded documents and sends them to Baidu's external translation service, but the description does not clearly disclose that third-party transmission occurs. This can cause sensitive files to be exfiltrated outside the local agent environment without informed user consent, especially for confidential business, legal, medical, or personal documents.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest says to trigger when the user 'uploads or references a file and asks to translate it, or asks to convert a document's language,' which is broad and lacks negative examples or tighter constraints. This can cause unintended invocation for ordinary conversation about documents or translation requests that are not meant to use this specific skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The description mixes English with fixed Chinese phrasing ('文件翻译、文档翻译') and points to a Baidu-specific workflow, but it does not state that Chinese is optional or that locale handling is user-selectable. Under the stated policy, locale-specific behavior should be opt-in or clearly justified when constrained to a region or language.
Content: No source excerpt is available for this finding.