simplified-to-traditional

• Outcome: Pass
• Latest audit: Oct 11, 2026 · 2:04 PM UTC
• Version: 1.0.2

Overview

This skill is a narrowly scoped Chinese article conversion helper, with one real caution that its script can overwrite the generated Traditional file if run without following the documented approval step.

Install only if you want an agent to update markdown article files for Simplified-to-Traditional Chinese synchronization. Before running it, confirm the exact source and output paths, check whether the -zh-hant.md file already exists, and keep changes under version control so an accidental overwrite can be reviewed or reverted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sync_tra.py:157

Finding

Existing Traditional article can be overwritten without enforced approval

Content

View full analysis

Vulnerability Details

File Location: scripts/sync_tra.py:157-180
Vulnerability Type: Missing executable overwrite-approval control
Risk Level: Medium

Vulnerable code:

python

ap.add_argument("source", help="path to the <YYMMDD-slug>-zh-hans.md Simplified article")
ap.add_argument("--check", action="store_true", help="report drift; do not write")
args = ap.parse_args()

src = Path(args.source)
if not src.is_file():
    sys.exit(f"source not found: {src}")

src_text, src_out, twin, twin_out = build(src)
lint = lint_traditional(twin_out)

if args.check:
    problems: list[str] = []
    if read(src) != src_out:
        problems.append(f"{src.name}: cross-link missing, stale, or needs normalizing")
    if not twin.is_file():
        problems.append(f"{twin.name}: missing")
    elif read(twin) != twin_out:
        problems.append(f"{twin.name}: out of sync with {src.name}")
    if problems:
        print("FAIL: not in sync")
        for p in problems:
            print("  -", p)
        report_lint(lint)
        return 1
    print(f"OK: {src.name} and {twin.name} are in sync")
    report_lint(lint)
    return 0

wrote: list[str] = []
if read(src) != src_out:
    src.write_text(src_out, encoding="utf-8")
    wrote.append(src.name)
twin.write_text(twin_out, encoding="utf-8")
wrote.append(twin.name)

Technical Analysis

SKILL.md requires explicit user approval before writing and specifically directs the Agent to stop and ask before overwriting an existing -zh-hant.md file. The executable implementation does not enforce this gate.

The only write-related option is --check. When that flag is absent, twin.write_text(twin_out, encoding="utf-8") replaces the generated twin regardless of whether it already exists. There is no interactive prompt, explicit --overwrite flag, approval token, or refusal-on-existence behavior.

The script may also modify the source article to insert or normalize its cross-link. Consequently, direct or mist ...[truncated 1440 chars]

Remediation

View remediation

Remediation Suggestions

• Refuse to write the twin when it already exists unless an explicit --overwrite or --force flag is supplied.
• Make write intent explicit, such as requiring --write, while retaining --check as a non-mutating mode.
• If interactive execution is supported, display the exact source and destination paths and require confirmation before replacement.
• Ensure non-interactive Agent workflows pass an explicit overwrite authorization flag only after receiving user approval.
• Consider atomic replacement using a temporary file in the destination directory followed by os.replace.
• Optionally create a backup before approved replacement to reduce accidental data-loss risk.
• Apply the same explicit write authorization policy to modifications of the Simplified source file.

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

python3 .opencode/skills/simplified-to-traditional/scripts/sync_tra.py docs/-zh-hans.md

text

It (a) injects/updates the Simplified file's `繁體版` cross-link, (b) converts the body with `opencc -c s2twp`, (c) injects the Traditional file's `简体版` cross-link, and (d) writes `docs/<slug>-zh-hant.md`.
5. **Review** the generated Traditional against the Simplified, and clear the script's lint. OpenCC can pick the wrong form for a 一简对多繁 character (see "OpenCC pitfalls" below) and can rewrite characters inside a quote. `sync_tra.py` prints a `⚠ … ambiguous form(s) to verify` list after every run — check each against the cited edition (or the intended meaning) and pin any genuine fix in `OVERRIDES`. Surface anything else suspicious to the user; do not silently hand-fix — a hand-edit is drift and will fail the next `--check`.
6. **Verify** the pair is in sync:
```bash
python3 .opencode/skills/simplified-to-traditional/scripts/sync_tra.py docs/<slug>-zh-hans.md --check

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

python3 .opencode/skills/simplified-to-traditional/scripts/sync_tra.py docs/-zh-hans.md

text

It (a) injects/updates the Simplified file's `繁體版` cross-link, (b) converts the body with `opencc -c s2twp`, (c) injects the Traditional file's `简体版` cross-link, and (d) writes `docs/<slug>-zh-hant.md`.
5. **Review** the generated Traditional against the Simplified, and clear the script's lint. OpenCC can pick the wrong form for a 一简对多繁 character (see "OpenCC pitfalls" below) and can rewrite characters inside a quote. `sync_tra.py` prints a `⚠ … ambiguous form(s) to verify` list after every run — check each against the cited edition (or the intended meaning) and pin any genuine fix in `OVERRIDES`. Surface anything else suspicious to the user; do not silently hand-fix — a hand-edit is drift and will fail the next `--check`.
6. **Verify** the pair is in sync:
```bash
python3 .opencode/skills/simplified-to-traditional/scripts/sync_tra.py docs/<slug>-zh-hans.md --check

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs the agent to read and write repository files and execute shell commands, but it does not declare any explicit tool/permission scope. That mismatch increases the chance of over-broad execution in environments that rely on skill metadata for confinement or review, and makes it harder to audit what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The instructions hard-code use of OpenCC s2twp, a Taiwan Traditional Chinese variant, as "the best default" for all conversions. This imposes a specific locale/script preference rather than offering a user choice or limiting the skill to a clearly region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file description and user-facing behavior are explicitly limited to Simplified/Traditional Chinese content, and the script emits Chinese labels such as 繁体版/簡體版 in generated output. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the constraint is clearly documented as a justified region-specific limitation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sync_tra.py (reported line 100)May include surrounding context.

python

def to_traditional(text: str) -> str:
    proc = subprocess.run(
        OPENCC, input=text.encode("utf-8"), stdout=subprocess.PIPE, stderr=subprocess.PIPE
    )
    if proc.returncode != 0:

Static analysis

No suspicious patterns detected.