Global Auto Translator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:50 AM UTC
• Version: 1.0.4

Overview

This translation skill is mostly coherent, but it monitors clipboard content and sends text to external translation services while also retaining clipboard snippets and using unsafe macOS dialog scripting.

Review before installing. Do not use this skill with passwords, API keys, private chats, legal documents, customer data, or confidential business files unless you are comfortable sending the text to third-party translation services. If installed, run it only when needed, configure excluded apps, stop the daemon after use, and be aware that it writes clipboard snippets to local state. The unsafe AppleScript handling should be fixed before routine use on macOS.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: translate-daemon.py:275

Finding

AppleScript Injection Through Clipboard and Translation Content

Content

View full analysis

%s)" % (lang_name, target_name) escaped_title = title.replace('"', '\\"') script = 'set theText to "%s"\ndisplay dialog theText with title "%s" with icon note buttons {"复制到剪贴板", "关闭"} default button 1\nbutton returned of result' % ( escaped_text, escaped_title) try: result = subprocess.run(["osascript", "-e", script], capture_output=True, text=True, timeout=60) return result.stdout.strip() except Exception: return None ``` ### Technical Analysis Clipboard content and remote translation results are interpolated into executable AppleScript source and passed to `osascript -e`. Replacin ...[truncated 2065 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: translate-daemon.py:116

Finding

Plaintext Retention of Sensitive Clipboard Content Without Translation Consent

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: setup.sh:23

Finding

Unpinned Dependencies Installed Into the User Python Environment

Content

View full analysis

&1 || \ pip3 install --user --break-system-packages requests langdetect pdfplumber python-docx docx2txt 2>&1 ``` ### Technical Analysis The setup script installs third-party packages without exact version constraints or integrity hashes. Each installation therefore resolves mutable package versions from the configured Python package index at execution time. The fallback adds `--break-system-packages`, bypassing protections intended to prevent pip from modifying externally managed Python environments. Although `--user` limits installation to the user environment, user-level Python packages can still affect other applications and scripts executed by that user. No evidence was found that the listed package names are deliberate typosquats or that the script uses a known malicious package source. The vulnerability is the absence of reproducible, integrity-verified dependency resolution and the unnecessary weakening of environment-management protections. ### Attack Path 1. A user runs the documented `setup.sh` installer. 2. `pip3` resolves the latest packages and transitive dependencies available from its configured index. 3. A compromised package release, package-index account, dependency, or maliciously configured index supplies altered code. 4. Package installation or subsequent import executes the supplied code under the user account. 5. The installed code can access resources available to that user and may affect other Python programs using the same user package directory. ### Impact Assessment A successful supply-chain compromise could execute arbitrary code with the installing user’s privileges. Potential impact includes access to user-readable files, credentials, clipboard dat ...[truncated 272 chars]

Remediation

View remediation

--hash=sha256: langdetect== --hash=sha256: pdfplumber== --hash=sha256: python-docx== --hash=sha256: docx2txt== --hash=sha256: ``` Also: - Remove the `--break-system-packages` fallback. - Invoke pip through the intended interpreter using `python3 -m pip`. - Review and pin all transitive dependencies. - Use a trusted package index explicitly where organizational policy requires it. - Add automated dependency vulnerability and provenance checks. - Remove unused dependencies; `docx2txt` was installed but no use was identified in the audited source. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly advertises a background clipboard-monitoring daemon that automatically reacts to copied text from browsers, chat apps, email, and other tools, but it does not disclose how clipboard contents are handled, stored, logged, or sent to third-party translation services. Clipboard data often contains sensitive material such as passwords, customer data, internal messages, or API keys, so missing privacy and data-handling warnings can lead users to expose confidential information without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document translation feature encourages users to submit PDF and Word files for translation but does not warn that file contents may be uploaded to external services such as MyMemory or DeepL. Business documents commonly contain contracts, pricing, customer information, and trade secrets, so undisclosed transmission to third parties creates confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and all user-facing prompts are written in Chinese, and the script does not provide any user opt-in or alternative locale. This matches the language/locale policy violation category because the skill imposes a specific language on users without offering choice or documenting a region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The config sets target_language to zh, which hard-codes a specific language preference. Under the policy, forcing a language or locale without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON maps English trade terms to Chinese equivalents throughout the file, but there is no natural-language indication that the skill is intentionally China-market specific or that users can opt into this locale. Under the policy rule for language/locale, forcing a specific language without user choice can be a policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level documentation says the tool preserves original layout, nested tables, and header/footer structure. In code, PDF handling extracts page text and writes a plain .txt file, and DOCX handling only iterates over top-level paragraphs while replacing run text, with no processing of tables, headers, or footers. This is an active contradiction between stated behavior and implementation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script processes document text through translate_text without any explicit warning, consent flow, or visible indication that content may be sent to an external translation backend defined in the companion module. In a document-translation context, inputs may contain sensitive business, legal, or personal data, so silent transmission to a third-party service creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The docstring for translate_docx states that formatting is preserved. However, the code empties all runs and writes translated text into a single run or a new run, which does not preserve original run-level styling, and it does not handle tables, headers, or footers. This contradicts the documented intent rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The command-line interface sets the default target language to zh and the surrounding user-facing strings are Chinese, which enforces a specific locale unless the user overrides it. Under the policy, forcing a language/locale without explicit opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

All visible prompts, status messages, and usage instructions are presented only in Chinese. This can violate language/locale policy when the skill imposes a specific language without opt-in or an explicit documented regional constraint.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 27)May include surrounding context.

sh

pip3 install --user --break-system-packages requests langdetect pdfplumber python-docx docx2txt 2>&1

# 创建配置目录
mkdir -p ~/.openclaw/global-auto-translator

echo ""
echo "========================================="

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill is presented as a translation engine, but it also continuously watches the system clipboard and inspects the active application, which is more invasive than the headline description suggests. That mismatch reduces informed consent and can cause users to expose sensitive data they would not knowingly submit to a background monitor.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All prompts, status messages, and usage text are presented in Chinese, including confirmation dialogs and error messages. The file does not offer an opt-in language selection or explain that the skill is intentionally restricted to Chinese-speaking users, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The daemon stores a truncated copy of the last clipboard text in plaintext state on disk under the user's home directory. Because clipboard data frequently contains secrets or sensitive business content, persistent storage increases exposure to other local processes, backups, forensic recovery, and later unintended disclosure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · translate-daemon.py (reported line 142)May include surrounding context.

python

def get_clipboard():
    try:
        result = subprocess.run(["pbpaste"], capture_output=True, text=True, timeout=2)
        return result.stdout.strip()
    except Exception:
        return ""

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · translate-daemon.py (reported line 150)May include surrounding context.

python

def set_clipboard(text):
    try:
        proc = subprocess.Popen(["pbcopy"], stdin=subprocess.PIPE, text=True)
        proc.communicate(input=text)
    except Exception:
        pass

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Clipboard contents are transmitted to third-party translation services, but the tool does not provide a clear upfront warning that sensitive copied data may leave the device. In the context of a background clipboard-monitoring daemon, this creates a substantial privacy and data-leak risk because users often copy passwords, tokens, personal data, contracts, or proprietary text.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This code sends clipboard-derived text to the external MyMemory translation service over the network. In the context of a background clipboard monitor, external transmission is security-relevant because users may inadvertently upload confidential or regulated data to a third party.

Content

Scanner excerpt · translate-daemon.py (reported line 191)May include surrounding context.

python

def translate_mymemory(text, target="zh"):
    try:
        source_lang = detect_language(text) or "en"
        url = "https://api.mymemory.translated.net/get"
        params = {"q": text[:4500], "langpair": f"{source_lang}|{target}"}
        resp = requests.get(url, params=params, timeout=10)
        resp.raise_for_status()

Tainted flow: 'text' from sys.stdin.read (line 459, user input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 94% confidence

Finding

Untrusted stdin or clipboard text is sent to an external translation API, which can expose sensitive user content to third parties. In this skill, the risk is amplified because the daemon continuously monitors clipboard contents and may transmit them once the user accepts a translation prompt, making accidental disclosure of secrets, credentials, or business data plausible.

Content

Scanner excerpt · translate-daemon.py (reported line 247)May include surrounding context.

python

try:
        url = "https://api-free.deepl.com/v2/translate"
        dl_target = "zh" if target.startswith("zh") else target
        resp = requests.post(url, data={"text": text[:5000], "target_lang": dl_target.upper()},
                            headers={"Authorization": "DeepL-Auth-Key " + config.get("deepl_api_key", "")}, timeout=10)
        data = resp.json()
        return data["translations"][0]["text"], target

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

User-controlled clipboard text is embedded into an AppleScript string passed to osascript. The code only escapes double quotes and newlines, which is not sufficient for AppleScript string/context safety; crafted clipboard content could break script syntax or potentially alter script behavior, creating an injection risk in a privileged UI automation context.

Content

Scanner excerpt · translate-daemon.py (reported line 282)May include surrounding context.

python

script = 'display dialog "%s" with title "%s" %s %s %s\nbutton returned of result' % (
        escaped_msg, escaped_title, button_list, default_btn, cancel_btn)
    try:
        result = subprocess.run(["osascript", "-e", script], capture_output=True, text=True, timeout=30)
        return result.stdout.strip()
    except Exception:
        return None

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 90% confidence

Finding

Translated text derived from untrusted clipboard content is inserted directly into dynamically generated AppleScript and executed with osascript. Because escaping is incomplete, malicious content could terminate the intended string or otherwise manipulate the AppleScript payload, leading to script injection or denial of service.

Content

Scanner excerpt · translate-daemon.py (reported line 298)May include surrounding context.

python

script = 'set theText to "%s"\ndisplay dialog theText with title "%s" with icon note buttons {"复制到剪贴板", "关闭"} default button 1\nbutton returned of result' % (
        escaped_text, escaped_title)
    try:
        result = subprocess.run(["osascript", "-e", script], capture_output=True, text=True, timeout=60)
        return result.stdout.strip()
    except Exception:
        return None

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · translate-daemon.py (reported line 306)May include surrounding context.

python

def play_sound():
    try:
        subprocess.run(["afplay", "/System/Library/Sounds/Glass.aiff"], capture_output=True, timeout=3)
    except Exception:
        pass

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · translate-daemon.py (reported line 313)May include surrounding context.

python

def get_active_app():
    try:
        result = subprocess.run(
            ["osascript", "-e", 'tell application "System Events" to get name of first application process whose frontmost is true'],
            capture_output=True, text=True, timeout=2)
        return result.stdout.strip()

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file presents all user-facing instructions in Chinese and does not indicate that the skill is intentionally limited to Chinese-speaking users or offer an alternative language. Per the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This shell script performs safety-relevant changes by installing packages with pip and creating a persistent directory under ~/.openclaw. While it prints that dependencies are being installed, it does not clearly warn the user about the specific side effects such as modifying the user Python environment and writing configuration files in the home directory.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: doc-translate.py:18