Aliyun Qwen Livetranslate

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:33 PM UTC
• Version:
  1.0.0

Overview

This skill is a small, coherent Alibaba Qwen LiveTranslate helper, with the main caveat that saved translation artifacts may contain sensitive speech or transcript data.

Before installing, be aware that any saved request payloads, transcripts, translations, or response summaries under the output directory may contain sensitive meeting or call content. Store them only where appropriate, redact or delete them when no longer needed, and handle any separate Alibaba Cloud credentials outside this skill with normal secret-management care.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file explicitly instructs the user to save translation session payloads and response summaries under an output directory. Because live translation can contain spoken personal, confidential, or business-sensitive content, the description should warn users that transcripts and payloads may persist sensitive data locally.

VirusTotal

66/66 vendors flagged this skill as clean.