ClawHub
Back to skill

Security audit

Xtranslate

Security checks for vulnerabilities and agentic risk

Overview

This document-translation skill appears functional, but it needs review because it can send document text to cloud providers and leaves sensitive local metadata and temporary files behind.

Install only if you are comfortable with document text being processed by selected cloud providers when cloud mode is used. Prefer local Ollama mode for sensitive files, use an isolated virtual environment, avoid committing generated monitor or summary files, delete tmp conversion files after use, and do not rely on the bundled API-key encryption as strong credential protection.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
src/crypto_utils.py:7
Finding

API Credentials Are Protected with a Public, Deterministic Encryption Key

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

All Third-Party Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/file_handler.py:55
Finding

PDF Conversion Uses Predictable Temporary Files Without Cleanup

Content
View full analysis
DOCX] 正在转换以进行分析...") current_work_path = handler.pdf_to_docx(file_path, CONFIG["PDF_TO_DOCX_TMP"]) paragraphs = handler.read_docx(current_work_path) analysis_text = "\n".join(paragraphs[:50]) # 取前50段进行分析 ``` ### Technical Analysis The temporary DOCX path is derived only from the input file's basename and a shared configured directory. It is therefore predictable and not unique. Two PDFs with the same basename produce the same temporary path, even if they originate from different directories. The implementation does not securely create the temporary file, does not enforce restrictive permissions, and does not delete it after processing. This conflicts with the documentation's statement that temporary conversion files are automatically cleaned. Predictable names permit collisions and may allow another local process or user with write access to the temporary directory to pre-create or replace the destination. At minimum, converted copies of sensitive documents remain on disk indefinitely. The exact consequences of link-based replacement depend on operating-system behavior, directory permissions, and how the conversion library opens its destination. Persistent disclosure and basename collision are directly evident from the code. ### Attack Path 1. A user tr ...[truncated 1090 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
translation_monitor.py:12
Finding

Translation Monitoring Persists Sensitive File Metadata in Plaintext

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (62)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 13)May include surrounding context.

text
*.log

# Environment files
.env
.env.*
!.env.example

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill promotes cloud translation engines but does not clearly warn that document contents will be transmitted to third-party model providers. Because the tool handles potentially sensitive PDFs, Word, Excel, and PPT files, lack of upfront disclosure can lead to unintended exfiltration of confidential content outside the local environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises capabilities that read files, write outputs, and use environment-provided API keys, but it does not declare an explicit tool scope or permission boundary. That increases the chance the agent will invoke file and secret-adjacent operations without clear user-visible constraints, especially in environments where skill permissions are expected to gate access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation phrases are broad enough to match ordinary translation requests, so the skill may be triggered when a user only wanted simple text translation rather than file processing. In context, this matters because invocation can cause local file access and possible cloud upload of document contents, making accidental activation more harmful than a harmless routing mistake.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill appears to automatically apply Chinese-specific formatting and keyword extraction behaviors without explicit user consent. In context this can alter document meaning, styling, or compatibility unexpectedly, and keyword extraction itself may process sensitive content beyond what users expect from a straightforward translation task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill describes smart monitoring and process recording without warning users that translation activity and document-related metadata may be logged. Even if full document bodies are not always stored, operational records about filenames, timing, languages, models, and excerpts can expose sensitive business or personal information.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The monitoring instructions say every translation is fully recorded, creating a data retention risk for user-provided document contents or content-derived metadata. In a document-translation skill, the context makes this especially sensitive because inputs may contain contracts, financial data, legal text, or personal information.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly states that all translation records are stored in a persistent JSON file, which creates an ongoing local data exposure risk. Persistent logs are easy to copy, inspect, back up, or leak, and they may reveal sensitive document names, processing details, and potentially excerpts or analysis artifacts over time.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains natural-language docstrings and all user-facing print output exclusively in Chinese, including the title, status messages, and recommendations. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file contains natural-language instructions and examples exclusively in Chinese, which can amount to forcing a specific language on users without opt-in. The policy allows locale constraints only when user choice is offered or the restriction is clearly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire markdown file presents the skill content exclusively in Chinese, including the title, section headings, comments, and explanatory bullets. Under the policy rule, forcing a specific language without an explicit user choice or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check-deps.py (reported line 31)May include surrounding context.

python
def check_package(package_name):
    """检查单个包是否已安装"""
    try:
        __import__(package_name)
        return True
    except ImportError:
        return False

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The string literal on L30 hard-codes the generated context prompt in English ('The text contains...' / 'Please ensure...'). This imposes a specific language on downstream behavior without user opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

This plain-text config sets TARGET_LANG=zh-CN as a global default, but the file provides no surrounding activation context or constraints explaining when this locale-specific behavior should apply. In a broadly applicable translation skill, a fixed default target language can overlap with many general translation requests and is not narrowed by explicit scope or negative examples.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The natural-language configuration sets TARGET_LANG=zh-CN, which imposes a specific locale by default. There is no indication in this file that users are offered a language choice or have explicitly opted into Chinese output, making it a language-policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The configuration includes multiple cloud translation endpoints but provides no in-file indication that translated content may be transmitted to third-party services. If users process sensitive documents, they may unknowingly send proprietary or personal data off-host, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The top-level documentation describes this module as a configuration loader that reads from config.txt, which implies read-oriented behavior. However, importing the module triggers os.makedirs on the output and temporary directories at L132-L136, introducing filesystem-modifying side effects not reflected by the docstring.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The configuration hard-codes a default target locale of "zh-CN", which forces a specific language/locale choice unless the user overrides it. This is a natural-language policy issue because the file does not indicate user choice, opt-in, or a documented region-specific justification for the default locale.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/config.txt (reported line 30)May include surrounding context.

text
"env_key": raw_config.get("CLOUD_MODEL_DEEPSEEK_ENV_KEY", "DEEPSEEK_API_KEY")
            },
            "GPT-4o": {
                "base_url": raw_config.get("CLOUD_MODEL_GPT4O_BASE_URL", "https://api.openai.com/v1"),
                "model": raw_config.get("CLOUD_MODEL_GPT4O_MODEL", "gpt-4o"),
                "env_key": raw_config.get("CLOUD_MODEL_GPT4O_ENV_KEY", "OPENAI_API_KEY")
            },

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/config_loader.py (reported line 58)May include surrounding context.

python
"env_key": raw_config.get("CLOUD_MODEL_DEEPSEEK_ENV_KEY", "DEEPSEEK_API_KEY")
            },
            "GPT-4o": {
                "base_url": raw_config.get("CLOUD_MODEL_GPT4O_BASE_URL", "https://api.openai.com/v1"),
                "model": raw_config.get("CLOUD_MODEL_GPT4O_MODEL", "gpt-4o"),
                "env_key": raw_config.get("CLOUD_MODEL_GPT4O_ENV_KEY", "OPENAI_API_KEY")
            },

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/config.txt (reported line 35)May include surrounding context.

text
"env_key": raw_config.get("CLOUD_MODEL_GPT4O_ENV_KEY", "OPENAI_API_KEY")
            },
            "Claude 3.5 Sonnet": {
                "base_url": raw_config.get("CLOUD_MODEL_CLAUDE_BASE_URL", "https://api.anthropic.com/v1"),
                "model": raw_config.get("CLOUD_MODEL_CLAUDE_MODEL", "claude-3-5-sonnet-20240620"),
                "env_key": raw_config.get("CLOUD_MODEL_CLAUDE_ENV_KEY", "ANTHROPIC_API_KEY")
            },

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/config_loader.py (reported line 63)May include surrounding context.

python
"env_key": raw_config.get("CLOUD_MODEL_GPT4O_ENV_KEY", "OPENAI_API_KEY")
            },
            "Claude 3.5 Sonnet": {
                "base_url": raw_config.get("CLOUD_MODEL_CLAUDE_BASE_URL", "https://api.anthropic.com/v1"),
                "model": raw_config.get("CLOUD_MODEL_CLAUDE_MODEL", "claude-3-5-sonnet-20240620"),
                "env_key": raw_config.get("CLOUD_MODEL_CLAUDE_ENV_KEY", "ANTHROPIC_API_KEY")
            },

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/config.txt (reported line 40)May include surrounding context.

text
"env_key": raw_config.get("CLOUD_MODEL_CLAUDE_ENV_KEY", "ANTHROPIC_API_KEY")
            },
            "SiliconFlow (Qwen2.5)": {
                "base_url": raw_config.get("CLOUD_MODEL_SILICONFLOW_BASE_URL", "https://api.siliconflow.cn/v1"),
                "model": raw_config.get("CLOUD_MODEL_SILICONFLOW_MODEL", "deepseek-ai/DeepSeek-V3"),
                "env_key": raw_config.get("CLOUD_MODEL_SILICONFLOW_ENV_KEY", "SILICONFLOW_API_KEY")
            },

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/config_loader.py (reported line 68)May include surrounding context.

python
"env_key": raw_config.get("CLOUD_MODEL_CLAUDE_ENV_KEY", "ANTHROPIC_API_KEY")
            },
            "SiliconFlow (Qwen2.5)": {
                "base_url": raw_config.get("CLOUD_MODEL_SILICONFLOW_BASE_URL", "https://api.siliconflow.cn/v1"),
                "model": raw_config.get("CLOUD_MODEL_SILICONFLOW_MODEL", "deepseek-ai/DeepSeek-V3"),
                "env_key": raw_config.get("CLOUD_MODEL_SILICONFLOW_ENV_KEY", "SILICONFLOW_API_KEY")
            },

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file performs file-system writes by creating the configured output and temporary directories as soon as the module is imported. Although there are comments, they are implementation notes rather than user-facing warnings, and there is no confirmation, logging, or explicit disclosure that importing the skill will modify the local filesystem.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.