Global Auto Translator

• Outcome: Review
• Latest audit: Jun 26, 2026 · 5:34 PM UTC
• Version: 1.0.4

Overview

This translator does what it says, but it monitors the clipboard and sends text/documents to third-party translation services with weak privacy disclosure and an AppleScript injection risk.

Install only if you are comfortable with copied text and translated documents being sent to third-party translation services. Avoid using it with passwords, API keys, customer data, legal/financial documents, or regulated information; configure excluded apps and stop the daemon when not needed. The AppleScript display code should be fixed before using it on untrusted or attacker-controlled text.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

script = 'display dialog "%s" with title "%s" %s %s %s\nbutton returned of result' % (
        escaped_msg, escaped_title, button_list, default_btn, cancel_btn)
    try:
        result = subprocess.run(["osascript", "-e", script], capture_output=True, text=True, timeout=30)
        return result.stdout.strip()
    except Exception:
        return None

• Confidence: 92% confidence
• Finding: User/clipboard-derived text is embedded into an AppleScript string passed to `osascript`. The code only escapes double quotes and newlines, which is not sufficient for safely embedding arbitrary text in AppleScript source; crafted content can break out of the intended string context and potentially execute unintended AppleScript commands.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

script = 'set theText to "%s"\ndisplay dialog theText with title "%s" with icon note buttons {"复制到剪贴板", "关闭"} default button 1\nbutton returned of result' % (
        escaped_text, escaped_title)
    try:
        result = subprocess.run(["osascript", "-e", script], capture_output=True, text=True, timeout=60)
        return result.stdout.strip()
    except Exception:
        return None

• Confidence: 92% confidence
• Finding: Translated text from external services is inserted directly into AppleScript code for display. Because the translation result is untrusted remote data and escaping is incomplete, a malicious or malformed translation response could inject AppleScript and trigger unintended local actions.

Tainted flow: 'text' from sys.stdin.read (line 459, user input) → requests.post (network output)

Medium

• Category: Data Flow

Content

try:
        url = "https://api-free.deepl.com/v2/translate"
        dl_target = "zh" if target.startswith("zh") else target
        resp = requests.post(url, data={"text": text[:5000], "target_lang": dl_target.upper()},
                            headers={"Authorization": "DeepL-Auth-Key " + config.get("deepl_api_key", "")}, timeout=10)
        data = resp.json()
        return data["translations"][0]["text"], target

• Confidence: 94% confidence
• Finding: Text from stdin is transmitted to an external translation API, which can expose sensitive or proprietary content to a third party. This is especially relevant for a translation tool because users may paste confidential business, customer, or credential-adjacent data expecting only local processing.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script exposes the --generate command to any local user, even though the function is described as intended only for the distributor. Because key validation relies solely on hashes stored in the same script, a local user can generate their own valid activation key and self-issue a Premium license, defeating the licensing model and enabling unauthorized feature access.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly advertises clipboard monitoring and automatic translation prompts, but it does not clearly warn users that copied content may include sensitive data and may be transmitted to external translation providers. Clipboard data often contains passwords, personal information, contracts, or business secrets, so silent or inadequately disclosed monitoring creates a real privacy and data-leakage risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The document translation feature encourages users to submit PDF and Word files but does not clearly disclose that full document contents may be transmitted to third-party translation services such as MyMemory or DeepL. This is dangerous because uploaded documents may contain confidential business records, customer data, or regulated information, and users are not given informed consent or handling guidance.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Document text is extracted and passed to the translation backend via translate_text() without any explicit warning, consent flow, or privacy notice. If the backend is remote, sensitive document contents such as contracts, personal data, or internal business information may be transmitted off-host unexpectedly, creating confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The manual translation code path reads user-supplied text and sends it to remote translation services without an explicit warning or confirmation. Users may assume piping text into a local script is local-only, creating a privacy and data-handling risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The daemon continuously monitors clipboard contents and, upon user prompt, sends detected foreign text to external translation services, but startup messaging does not clearly disclose off-device transmission. Clipboard data often contains passwords, API keys, contracts, PII, or commercial secrets, making this context substantially more dangerous than ordinary translation input.

External Transmission

Medium

• Category: Data Exfiltration

Content

def translate_mymemory(text, target="zh"):
    try:
        source_lang = detect_language(text) or "en"
        url = "https://api.mymemory.translated.net/get"
        params = {"q": text[:4500], "langpair": f"{source_lang}|{target}"}
        resp = requests.get(url, params=params, timeout=10)
        resp.raise_for_status()

• Confidence: 94% confidence
• Finding: This code sends text to the external MyMemory translation service, creating a real data-exfiltration/privacy exposure. In this skill's context, the text often comes from the clipboard or stdin and may include sensitive business or personal information.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def get_clipboard():
    try:
        result = subprocess.run(["pbpaste"], capture_output=True, text=True, timeout=2)
        return result.stdout.strip()
    except Exception:
        return ""

• Confidence: 95% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Unvalidated Output Injection

High

• Category: Output Handling

Content

script = 'display dialog "%s" with title "%s" %s %s %s\nbutton returned of result' % (
        escaped_msg, escaped_title, button_list, default_btn, cancel_btn)
    try:
        result = subprocess.run(["osascript", "-e", script], capture_output=True, text=True, timeout=30)
        return result.stdout.strip()
    except Exception:
        return None

• Confidence: 93% confidence
• Finding: Clipboard-derived content is reflected into executable AppleScript source used by `osascript`. Because escaping is incomplete, specially crafted text can turn a dialog display into script injection and local command execution through AppleScript automation.

Unvalidated Output Injection

High

• Category: Output Handling

Content

script = 'set theText to "%s"\ndisplay dialog theText with title "%s" with icon note buttons {"复制到剪贴板", "关闭"} default button 1\nbutton returned of result' % (
        escaped_text, escaped_title)
    try:
        result = subprocess.run(["osascript", "-e", script], capture_output=True, text=True, timeout=60)
        return result.stdout.strip()
    except Exception:
        return None

• Confidence: 93% confidence
• Finding: Remote translation output is injected into AppleScript source and then executed by `osascript`. This creates an untrusted-output-to-code path where a compromised or malicious translation response could drive arbitrary AppleScript behavior on the host.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def play_sound():
    try:
        subprocess.run(["afplay", "/System/Library/Sounds/Glass.aiff"], capture_output=True, timeout=3)
    except Exception:
        pass

• Confidence: 95% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def get_active_app():
    try:
        result = subprocess.run(
            ["osascript", "-e", 'tell application "System Events" to get name of first application process whose frontmost is true'],
            capture_output=True, text=True, timeout=2)
        return result.stdout.strip()

• Confidence: 95% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: doc-translate.py:18