WJS Translating Subtitles

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 8.0.0

Overview

The subtitle-translation instructions are mostly coherent, but the packaged script can execute unaudited Python code from outside the skill package.

Review before installing or invoking the script. The written skill instructions are narrow and subtitle-focused, but the Python entrypoint relies on code outside the package, so only use it in an environment where that external integration path is trusted and controlled.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/translate.py:3

Finding

Untrusted External Python Module Loading Through Search Path Manipulation

Content

View full analysis

Vulnerability Details

File Location: scripts/translate.py, lines 3–6
Vulnerability Type: Untrusted module loading and local tool hijacking
Risk Level: High

python

import sys, os
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "integration"))
from translate_srt import main
if __name__ == "__main__":
    main()

Technical Analysis

The script prepends an external directory to Python's module search path before importing translate_srt. Based on the audited project location, the constructed path resolves outside the project to /tmp/integration.

Because this external directory is placed at index zero of sys.path, a file named translate_srt.py located there takes precedence over modules from other locations. Python executes top-level module code immediately during the import, before main() is called.

The translate_srt implementation is not included in the audited project. Consequently, its integrity and behavior cannot be verified, and the executable behavior of the Skill is not constrained to the text-only subtitle processing documented in SKILL.md. If an attacker can create or replace /tmp/integration/translate_srt.py, the import becomes an arbitrary-code execution primitive.

Attack Path

1. An attacker gains write access to /tmp/integration, or creates that directory if it does not exist.
2. The attacker places a malicious file at /tmp/integration/translate_srt.py.
3. A user or Agent invokes scripts/translate.py.
4. The script prepends /tmp/integration to sys.path.
5. Python imports the attacker-controlled module in preference to any trusted implementation.
6. Malicious top-level code executes immediately during import.
7. If execution continues, the attacker-controlled main() function is invoked as well.

Impact Assessment

Successful exploitation permits arbitrary Python code execution with the same operating-system iden ...[truncated 740 chars]

Remediation

View remediation

Remediation Suggestions

1. Move translate_srt.py into the Skill package and import it through a package-relative, auditable path.

2. Remove the sys.path.insert() call and avoid loading executable modules from parent directories, temporary locations, or other externally writable paths.

3. Package the implementation explicitly, for example:

   python

   from .translate_srt import main
   

   Alternatively, use a properly installed, pinned package imported through its canonical package name.

4. If an external integration is operationally unavoidable, resolve it from a trusted configuration rather than a relative traversal path. Validate that the directory and file are owned by an expected trusted identity and are not writable by untrusted users.

5. Verify the external module against a pinned cryptographic digest or signed manifest before loading it, and fail closed if verification fails.

6. Avoid placing the external directory at the front of the global module search path. Load only the explicitly validated file and prevent unintended transitive imports from the same directory.

7. Run the translation process with least privilege and restrict filesystem, credential, subprocess, and network access to reduce impact if module integrity is compromised.

8. Include the complete executable implementation and its dependencies in future audits so the documented translation behavior can be compared with the code actually executed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

When TTS dubbing follows: the punctuation-bounded structure means each TTS clip is a complete utterance with proper end-intonation, and concatenating clips sounds natural because every join is at a real pause point.

SRT output rules

text

1

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction says to use Simplified characters only and not use Traditional Hanzi unless the user explicitly asks. This imposes a specific locale/script default for Chinese output without opt-in, which can violate language/locale policy where users may expect a choice between Chinese variants.

Content

No source excerpt is available for this finding.