ClawHub
Back to skill

Security audit

Excel Translator

Security checks for vulnerabilities and agentic risk

Overview

This Excel translation skill is purpose-aligned, but it should be reviewed because it sends spreadsheet text to an external LLM service and reads local API credential sources without a clear consent or scoping step.

Install only if you are comfortable sending the workbook's text cells to the configured OpenAI-compatible API endpoint. Avoid using it on confidential, regulated, financial, or personal spreadsheets unless your organization allows that data flow, and verify the OPENAI_BASE_URL and credential source before running it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared behavior suggests a straightforward Excel translation utility, but the skill also sends workbook text to an external API and uses local credentials without clearly declaring those capabilities. That mismatch can cause sensitive spreadsheet contents to be exfiltrated unexpectedly and mislead users about how their data is processed.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill omits a privacy warning that workbook text is transmitted to an external API for translation. Because spreadsheets often contain proprietary, financial, or personal information, silent external transmission materially increases confidentiality risk in this context.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes a Python script that relies on environment-provided API credentials, but the manifest does not declare any tool scope or permission boundaries. This creates a transparency and governance gap: operators and users cannot easily tell that the skill can access secrets and perform code-driven actions.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The description states the skill translates Excel files from English to Chinese for any applicable user task, presenting a fixed language output rather than offering language selection or documenting a narrowly justified regional requirement. This can violate language/locale policy when a specific language is imposed without user opt-in.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill does not prominently warn that it will create a modified translated workbook automatically in the same directory, which can surprise users and lead to unintended overwrites, data sprawl, or handling mistakes with sensitive files. In file-processing skills, undisclosed write behavior is a real safety issue because users may assume analysis-only behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
The script reads API credentials from environment variables. These are pre-configured in the Manus sandbox:

- `OPENAI_API_KEY` — API key for the translation model.
- `OPENAI_BASE_URL` — Base URL for the API endpoint (defaults to `https://api.openai.com/v1`).

## Bundled Resources
Confidence
95% confidence
Finding
The skill explicitly uses an external API endpoint, meaning workbook contents leave the local environment during translation. External transmission is especially sensitive for Excel files because they commonly contain confidential business or personal data, so the context makes this more dangerous than ordinary network use.

External Transmission

Medium
Category
Data Exfiltration
Content
_secrets = _load_secret()
_api_key = _secrets.get("OPENAI_API_KEY") or os.environ.get("OPENAI_API_KEY", "")
_base_url = _secrets.get("OPENAI_BASE_URL") or os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1")

client = OpenAI(api_key=_api_key, base_url=_base_url)
Confidence
92% confidence
Finding
The code is explicitly configured to transmit workbook contents to a remote API endpoint, with a default of https://api.openai.com/v1. In the context of an Excel translation skill, this is expected functionality, but it still creates real data-exposure risk if users process sensitive spreadsheets without realizing their contents leave the local environment.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script sends workbook cell contents to an external LLM service for translation, but it does not provide an explicit warning, consent gate, or privacy notice to the user. Excel files often contain sensitive business, financial, or personal data, so silent transmission to a third-party API can cause confidentiality violations and compliance issues.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest says the skill translates Excel files while preserving all formatting, images, and charts. However, the implementation modifies each translated cell's value by adding a newline plus Chinese text and explicitly sets wrap_text=True, which can alter layout and presentation even if other workbook objects remain intact.

Intent-Code Divergence

Low
Confidence
89% confidence
Finding
The header comment explicitly states that the script sends one sheet at a time to the LLM, batched by sheet. The actual code splits each sheet into batches of 100 cells before calling the model, so the documentation contradicts the real request granularity.

Context-Inappropriate Capability

Low
Confidence
80% confidence
Finding
The manifest describes an Excel translation skill but does not indicate any credential-loading behavior or dependency on local secret material. Reading ~/.openai/secret and environment variables introduces access to local sensitive configuration beyond the user-provided Excel file workflow.

Static analysis

No suspicious patterns detected.