Image Translator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This translation skill appears purpose-built, but it handles API credentials and user content in ways users should review before installing.

Review this before installing if you may translate confidential, regulated, internal, or personal content. Use it only with data you are allowed to send to Xiangji/Tosoiot translation services, avoid internal or signed image URLs, and prefer modifying the scripts to read credentials from environment variables or a secure secret store instead of command-line flags.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/text_translate.py:65
• Finding: Translation credentials exposed through command-line arguments<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/text_translate.py:65` - `scripts/image_translate.py:126-127` - `SKILL.md:51-55` - `SKILL.md:97-102` **Vulnerability Type**: Sensitive credentials passed through process command-line arguments **Risk Level**: Medium ### Vulnerable Code `scripts/text_translate.py:65`: ```python parser.add_argument("--api-key", required=True, help="Text translation key (TextTransKey)") ``` The source code uses a Chinese help string; its functional meaning is shown in English above. `scripts/image_translate.py:126-127`: ```python parser.add_argument("--img-key", required=True, help="ImgTransKey") parser.add_argument("--user-key", required=True, help="UserKey") ``` `SKILL.md:51-55` documents direct command-line use of the text translation credential: ```bash python scripts/text_translate.py \ --api-key YOUR_TEXT_TRANS_KEY \ --texts "你好世界" \ --source-language CHS \ --target-language ENG ``` `SKILL.md:97-102` documents direct command-line use of the image translation credentials: ```bash python scripts/image_translate.py \ --img-key YOUR_IMG_TRANS_KEY \ --user-key YOUR_USER_KEY \ --file /path/to/image.png \ --source-language JPN \ --target-language ENG ``` ### Technical Analysis The scripts require API credentials to be supplied as ordinary command-line arguments. Depending on the operating system and execution environment, command-line arguments may be exposed through: - Shell history files. - Process inspection interfaces and utilities. - CI/CD job output or retained workflow metadata. - Debugging, monitoring, telemetry, or endpoint-management software. - Wrapper scripts and orchestration logs. The text translation API key is transmitted directly to the documented HTTPS endpoint in the `X-API-Key` header. For image translation, the `UserKey` is used with the `ImgTransKey` and timestamp to create an MD5 request signature. Although the `UserKey` is not directly included in the outbound req ...[truncated 2089 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Stop requiring secrets as command-line arguments.** - Read credentials from protected environment variables such as `XIANGJI_TEXT_API_KEY`, `XIANGJI_IMG_KEY`, and `XIANGJI_USER_KEY`. - Alternatively, use an interactive password prompt implemented with `getpass.getpass()` so input is not echoed or included in process arguments. 2. **Support permission-restricted credential files where automation is required.** - Require restrictive file permissions, such as owner read/write only. - Reject or warn about credential files readable by other users. - Do not store secrets in the project directory or source-control repository. 3. **Retain command-line credential flags only as a deprecated compatibility mechanism, if necessary.** - Display a clear warning explaining that command-line secrets may be visible in process lists, history, and logs. - Prefer environment variables or secure secret stores whenever both mechanisms are available. 4. **Update every example in `SKILL.md`.** - Replace literal secret arguments with environment-variable or protected-input examples. - Explain the data sent to the external translation service and advise users not to translate confidential material unless the service's privacy and retention terms are acceptable. 5. **Harden operational usage.** - Inject secrets through the secret-management facilities of the relevant CI/CD or orchestration platform. - Mask credential values in logs. - Rotate the affected keys if they have already appeared in shell history, process captures, or build logs. - Apply account quotas and monitor for unexpected translation activity. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly supports uploading local image files and remote image URLs to third-party translation APIs, but the documentation in this section does not clearly warn users that image contents and linked resources are transmitted off-system to external services. This can lead to inadvertent disclosure of sensitive data contained in images or URLs, especially because users may assume a local-processing workflow from the CLI examples.

External Transmission

Medium

• Category: Data Exfiltration

Content

| 功能 | 端点 |
|------|------|
| 文本翻译 | `POST https://api.tosoiot.com/task/v1/text/translate` |
| 图片翻译（文件） | `POST https://api2.tosoiot.com/` |
| 图片翻译（URL 批量） | `POST https://api.tosoiot.com/` |

• Confidence: 82% confidence
• Finding: The documented text translation endpoint sends user-provided text to an external service, which is a real data-exposure concern in a translation skill because submitted content may contain confidential or regulated information. In context this is expected functionality rather than overtly malicious behavior, but it still creates privacy and compliance risk if users are not clearly informed and given safe-use guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

|------|------|
| 文本翻译 | `POST https://api.tosoiot.com/task/v1/text/translate` |
| 图片翻译（文件） | `POST https://api2.tosoiot.com/` |
| 图片翻译（URL 批量） | `POST https://api.tosoiot.com/` |

---

• Confidence: 90% confidence
• Finding: The documented image translation URL batch endpoint transmits user-supplied image references and likely associated image content to an external service, which can expose sensitive images or internal resource locations. This is more dangerous in this skill's context because it encourages bulk URL submission and image handling without adjacent warnings about privacy, authorization, or external processing.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains user-facing natural-language instructions entirely in Chinese, including the module docstring and usage examples. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation because it can exclude users who do not read that language.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-F", f"EngineType={engine_type}"])
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        if result.returncode == 0:
            return json.loads(result.stdout)
        else:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

API_URL = "https://api.tosoiot.com/task/v1/text/translate"


def translate_text(api_key: str, texts: list, source_language: str, target_language: str, vendor: str = None) -> dict:

• Confidence: 87% confidence
• Finding: The code is explicitly designed to send content to an external API endpoint, which is expected for a translation client, but it still represents a genuine external data exfiltration path. In this context the danger is contextual rather than overtly malicious: any sensitive text supplied to the tool is transmitted off-host to a third party.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script transmits both user-supplied text and an API key to a third-party remote service, but it does not clearly warn the user that their input leaves the local environment. This creates a real confidentiality and privacy risk, especially if users translate sensitive content or mistakenly assume processing is local-only.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: Natural-language instructions and user-facing CLI descriptions are provided only in Chinese, with no indication that users can select another language. Under the policy, forcing a specific language without user opt-in can be a locale/language policy issue.

Static analysis

No suspicious patterns detected.