T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:41- Finding
Unrestricted URL Retrieval Enables Local and Internal Resource Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
Translate Image
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but its URL-download path and external image upload are under-scoped enough to require review before use.
Install only if you are comfortable sending images and extracted text to translateimage.io. Avoid using it on confidential, medical, financial, identity, or private-location images unless you have explicit consent. Do not let it process file://, localhost, private-network, metadata-service, or redirected URLs; prefer known local image files or ordinary public HTTPS image URLs. Use remove-text only on images you have rights to edit, and avoid removing watermarks, provenance, or safety labels without authorization.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:43- Finding
Predictable Temporary File and Overbroad Wildcard Cleanup
- Content
View full analysis
.jpg` as a symbolic link to a file writable by the Agent. 3. The Agent executes the documented `curl -o "$IMAGE_PATH"` command. 4. `curl` follows the symbolic link and overwrites or truncates the target with downloaded content. 5. If th ...[truncated 1126 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md env: - TRANSLATEIMAGE_API_KEY bins: - curl - python3 primaryEnv: TRANSLATEIMAGE_API_KEY os: ["darwin", "linux", "win32"]
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Example:
bash curl -s -X POST https://translateimage.io/api/ocr \ -H "Authorization: Bearer $TRANSLATEIMAGE_API_KEY" \ -F "image=@$IMAGE_PATH"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - Images over 5MB may take longer — inform the user - Inpainting works best on simple backgrounds; complex textures may show artifacts - `gemini-2.5-flash` is the recommended default translator — fast and high quality - Clean up temp files after processing: `rm -f /tmp/ti-image-*.jpg /tmp/ti-image-$$.jpg`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill clearly instructs sending user-provided images to a third-party service, but it does not require an explicit user-facing privacy notice or consent step before transmission. Images can contain sensitive personal, financial, medical, or location data, so silent exfiltration to an external API creates a real privacy and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The remove-text feature can be used to erase watermarks, subtitles, ownership notices, or other provenance indicators, yet the skill provides no warning or restriction around misuse. That omission makes it easier to facilitate potentially improper content alteration and can enable copyright, attribution, or trust-related abuse.
- Content
Static analysis
No suspicious patterns detected.