T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/text_translate.py:65- Finding
Translation credentials exposed through command-line arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Image Translator
Security checks for vulnerabilities and agentic risk
Overview
This translation skill appears purpose-built, but it handles API credentials and user content in ways users should review before installing.
Review this before installing if you may translate confidential, regulated, internal, or personal content. Use it only with data you are allowed to send to Xiangji/Tosoiot translation services, avoid internal or signed image URLs, and prefer modifying the scripts to read credentials from environment variables or a secure secret store instead of command-line flags.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly supports uploading local image files and remote image URLs to third-party translation APIs, but the documentation in this section does not clearly warn users that image contents and linked resources are transmitted off-system to external services. This can lead to inadvertent disclosure of sensitive data contained in images or URLs, especially because users may assume a local-processing workflow from the CLI examples.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
The documented text translation endpoint sends user-provided text to an external service, which is a real data-exposure concern in a translation skill because submitted content may contain confidential or regulated information. In context this is expected functionality rather than overtly malicious behavior, but it still creates privacy and compliance risk if users are not clearly informed and given safe-use guidance.
- Content
md | 功能 | 端点 | |------|------| | 文本翻译 | `POST https://api.tosoiot.com/task/v1/text/translate` | | 图片翻译（文件） | `POST https://api2.tosoiot.com/` | | 图片翻译（URL 批量） | `POST https://api.tosoiot.com/` |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The documented image translation URL batch endpoint transmits user-supplied image references and likely associated image content to an external service, which can expose sensitive images or internal resource locations. This is more dangerous in this skill's context because it encourages bulk URL submission and image handling without adjacent warnings about privacy, authorization, or external processing.
- Content
md |------|------| | 文本翻译 | `POST https://api.tosoiot.com/task/v1/text/translate` | | 图片翻译（文件） | `POST https://api2.tosoiot.com/` | | 图片翻译（URL 批量） | `POST https://api.tosoiot.com/` | ---
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains user-facing natural-language instructions entirely in Chinese, including the module docstring and usage examples. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation because it can exclude users who do not read that language.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["-F", f"EngineType={engine_type}"]) try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=120) if result.returncode == 0: return json.loads(result.stdout) else:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The code is explicitly designed to send content to an external API endpoint, which is expected for a translation client, but it still represents a genuine external data exfiltration path. In this context the danger is contextual rather than overtly malicious: any sensitive text supplied to the tool is transmitted off-host to a third party.
- Content
python import urllib.request import urllib.error API_URL = "https://api.tosoiot.com/task/v1/text/translate" def translate_text(api_key: str, texts: list, source_language: str, target_language: str, vendor: str = None) -> dict:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script transmits both user-supplied text and an API key to a third-party remote service, but it does not clearly warn the user that their input leaves the local environment. This creates a real confidentiality and privacy risk, especially if users translate sensitive content or mistakenly assume processing is local-only.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Natural-language instructions and user-facing CLI descriptions are provided only in Chinese, with no indication that users can select another language. Under the policy, forcing a specific language without user opt-in can be a locale/language policy issue.
- Content