Translate EN ZH

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This is a simple Chinese-English translation skill with file export scripts, and the main issues are quality and disclosure gaps rather than malicious behavior.

Install only if you are comfortable with a basic demo-level translator. For files, review output paths before running the scripts, avoid using sensitive documents unless you trust the runtime, and do not expect real terminology alignment or exact Markdown preservation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code generally matches the declared domain of Chinese-English translation and does support single-text translation plus batch file translation. However, a key declared capability—术语对齐 (terminology alignment)—is entirely absent. In addition, the implementation is only a placeholder/demo translator using a tiny hardcoded dictionary and prefix-based fallback, not a real translation system as the description suggests for translating documents, code comments, emails, and batch tasks. There are no suspicious undeclared behaviors such as network access, data exfiltration, or unrelated resource usage, but the stated functionality is overstated relative to the actual code.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises batch file translation and export capabilities, implying file read/write behavior, but it declares no explicit tool scope or permissions. This creates a governance gap where the runtime may permit broader file access than users or reviewers expect, increasing the chance of unintended file access or modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest says the skill applies when the user mentions keywords like "翻译" along with broader translation scenarios, but it does not define clear limits, exclusions, or negative examples. Because "翻译" is a common everyday term, this could cause unintended invocation outside a narrowly scoped context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The entire skill description and usage guidance are written as a Chinese-only interaction model for a bilingual translation tool, but it does not explicitly offer the user a choice of response language or justify a locale restriction. For a translation skill, forcing one language without opt-in can violate language or locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation describes batch file translation and exporting translated files but does not warn that files may be created or modified. In a skill with file I/O capability, this can lead to users unintentionally authorizing destructive or privacy-impacting actions, especially if outputs overwrite originals or process sensitive documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains natural-language descriptions exclusively in Chinese, including the module docstring and later user-facing CLI help/output strings. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation because users are not offered a locale or language choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The docstring says the tool '保留原始格式，仅翻译文本内容', implying formatting is preserved. However, the implementation rewrites lines by reconstructing list markers, headings, quotes, emphasis, and always appending a trailing newline, which can change exact formatting and Markdown semantics rather than only translating text.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comment on L121 states '代码不翻译', but bold/italic/link/image substitutions are performed before splitting on inline code. As a result, Markdown-like text appearing inside backticks can already be passed to translate_text before the code-preservation logic runs, contradicting the stated intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code contains user-facing natural-language strings and argument constraints that limit translation targets to only Chinese and English. Under the policy, forcing a specific language or locale without explicit user choice is a natural-language policy violation unless clearly justified as region-specific, which is not documented here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.