Naver Papago Translate

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward Naver Papago translation tool, with ordinary third-party API and credential risks that users should understand before use.

Install only if you are comfortable sending the text you translate or detect to Naver's external API. Prefer NAVER_CLIENT_ID and NAVER_CLIENT_SECRET environment variables over --client-secret, avoid translating secrets or regulated data without approval, and prefer the packaged install over the optional GitHub source install unless you have reviewed that source.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/papago_translate/cli.py:18

Finding

Client Secret Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: src/papago_translate/cli.py:18
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

p.add_argument("--client-secret", dest="client_secret", default=None, help="Override NAVER_CLIENT_SECRET")

The insecure credential-passing mechanism is also promoted in README.md:75 and described as supported in SKILL.md:79.

Technical Analysis

The CLI accepts a Naver API client secret directly through the --client-secret argument. Command-line arguments are not an appropriate channel for secrets because they can be retained or exposed through:

• Shell command history
• Process inspection tools and process metadata
• /proc interfaces on applicable operating systems
• Endpoint monitoring and process-execution telemetry
• CI/CD logs, diagnostic output, or automation wrappers that record invoked commands

The application does not intentionally log the argument, including in verbose mode. However, that does not prevent external operating-system or monitoring facilities from capturing it before or during execution.

Attack Path

1. A user follows the documented configuration option and invokes the CLI with --client-secret.
2. The secret becomes part of the process argument vector and may also be saved in shell history.
3. Another local account with sufficient process-observation access, an endpoint-monitoring service, or a log collector records the command line.
4. The observer extracts the Naver client secret and the associated client ID if it was supplied similarly or otherwise available.
5. The exposed credentials are used to submit unauthorized requests to the Naver Papago API until they are revoked or restricted.

This path requires access to command histories, process metadata, or execution telemetry; the code does not transmit the credential to an undeclared third party.

Impa

...[truncated 613 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --client-secret command-line option and prefer the existing NAVER_CLIENT_SECRET environment-variable mechanism.
2. For interactive use, support secure prompting with Python's getpass.getpass() so the secret is not echoed or placed in the process argument vector.
3. For automation, optionally support reading the secret from a protected file descriptor or a credential file whose permissions are validated before use.
4. Remove recommendations to pass secrets through flags from README.md and SKILL.md.
5. Add a migration warning if the option must temporarily remain for compatibility, explaining that command-line values may be visible to other users and monitoring systems.
6. Recommend immediate credential rotation if a real secret has previously been supplied through command-line arguments or committed to automation logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

nes.

• You prefer official Naver Developer credentials over scraping.

Prerequisites

1. Get credentials from Naver Developers → create a Papago NMT app.
2. Export environment variables:

bash

export NAVER_CLIENT_ID="your-client-id"
export NAVER_CLIENT_SECRET="your-client-secret"

3. Install:

bash

pip install naver-papago-translate
# or from source
pip install git+https://github.com/ChloePark85/naver-papago-translate

CLI

bash

papago-translate --source ko --target en "안녕하세요, 만나서 반가워요!"
# → Hello, nice to meet you!

# Auto-detect source
papago-translate --detect --target ko "See you tomorrow!"

# Read from file, JSON output
papago-translate -s ko -t en -f notes.txt --json

Options: -s/--source, -t/--target (required), -f/--file, --detect, --json, --timeout, -v/--verbose.

Python API

python

from papago_translate import translate_text, detect_language

out = translate_text("ko",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README prominently describes translating arbitrary text through Naver Papago over HTTPS, but it does not clearly warn users that submitted content is transmitted to a third-party external service for processing. In an automation or agent-skill context, this can lead to unintentional disclosure of sensitive prompts, documents, credentials, or regulated data if users assume processing is local or do not appreciate the off-system data flow.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares use of environment variables, file input, and network access but does not explicitly scope or document permitted tools/permissions. In an agent environment, missing tool scope weakens policy enforcement and can allow broader-than-expected access, especially since the skill sends data externally and can read user-provided files for translation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description and usage text do not prominently warn that submitted text and file contents are transmitted to Naver's external API for processing. This creates a real data-handling risk because users may pass sensitive content under the assumption translation occurs locally, causing unintended disclosure of secrets, proprietary text, or personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function sends user-provided text to Naver's external translation API, which creates a real privacy and data-handling risk if callers pass sensitive content without realizing it leaves the local environment. In an automation skill, this is especially relevant because the code provides no disclosure, consent mechanism, or guardrail to prevent secrets, personal data, or proprietary text from being transmitted to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The language-detection method also transmits raw user text to an external API, so even short snippets or prompts may disclose confidential, personal, or regulated information to a third party. Because language detection may appear harmless to users, the lack of disclosure or consent can increase the chance of accidental data exfiltration in Korean-centric workflow automation.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.