ClawHub
Back to skill

Security audit

deepL Translate

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed DeepL API helper that sends user-selected text or files to DeepL and can manage DeepL glossaries when explicitly invoked.

Install this only if you are comfortable sending selected text, glossary entries, or documents to DeepL under your DeepL account. Be cautious with glossary delete/replace commands and document output paths, because those actions can change remote glossary data or overwrite a local file.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (23)

Tainted flow: 'request' from os.environ.get (line 313, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/deepl_translate.py (reported line 320)May include surrounding context.

python
method=method,
    )
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            raw = response.read()
            headers = dict(response.headers.items())
            headers_lower = {key.lower(): value for key, value in headers.items()}

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
python3 scripts/deepl_translate.py <子命令> ...

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
python3 scripts/deepl_translate.py <子命令> ...

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
python3 scripts/deepl_translate.py <子命令> ...

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
python3 scripts/deepl_translate.py <子命令> ...

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
python3 scripts/deepl_translate.py <子命令> ...

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
python3 scripts/deepl_translate.py <子命令> ...

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
python3 scripts/deepl_translate.py <子命令> ...

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
python3 scripts/deepl_translate.py <子命令> ...

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md
python3 scripts/deepl_translate.py <子命令> ...

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
python3 scripts/deepl_translate.py <子命令> ...

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/deepl_api.md (reported line 120)May include surrounding context.

md
- `POST /v2/glossaries`
- `GET /v2/glossaries/{glossary_id}`
- `GET /v2/glossaries/{glossary_id}/entries`
- `DELETE /v2/glossaries/{glossary_id}`

创建常见字段：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/deepl_api.md (reported line 141)May include surrounding context.

md
- `POST /v3/glossaries`
- `GET /v3/glossaries/{glossary_id}`
- `PATCH /v3/glossaries/{glossary_id}`
- `DELETE /v3/glossaries/{glossary_id}`
- `GET /v3/glossaries/{glossary_id}/entries`
- `PUT /v3/glossaries/{glossary_id}/dictionaries`
- `DELETE /v3/glossaries/{glossary_id}/dictionaries`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/deepl_api.md (reported line 144)May include surrounding context.

md
- `DELETE /v3/glossaries/{glossary_id}`
- `GET /v3/glossaries/{glossary_id}/entries`
- `PUT /v3/glossaries/{glossary_id}/dictionaries`
- `DELETE /v3/glossaries/{glossary_id}/dictionaries`

创建或更新常见字段：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/deepl_api.md (reported line 160)May include surrounding context.

md
- v3 glossary 支持多语言对，优先级高于 v2。
- `PATCH` 适合改名称或向指定字典合并条目。
- `PUT /dictionaries` 适合整包替换某个语言对字典。
- `DELETE /dictionaries` 适合只删除某个语言对，而不是整个 glossary。

## 响应说明

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/deepl_translate.py (reported line 197)May include surrounding context.

python
glossary_v3_put.add_argument("--entries-file", help="从文件读取条目。")
    glossary_v3_put.add_argument("--entries-format", choices=["csv", "tsv"], default="tsv", help="条目格式。默认 tsv。")

    glossary_v3_delete_dict = subparsers.add_parser("glossary-v3-delete-dict", help="删除 v3 字典", description="调用 DELETE /v3/glossaries/{id}/dictionaries 删除指定语言对字典。")
    add_common_options(glossary_v3_delete_dict)
    glossary_v3_delete_dict.add_argument("--glossary-id", required=True, help="glossary ID。")
    glossary_v3_delete_dict.add_argument("--source-lang", required=True, help="源语言代码。")

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/deepl_translate.py (reported line 203)May include surrounding context.

python
glossary_v3_delete_dict.add_argument("--source-lang", required=True, help="源语言代码。")
    glossary_v3_delete_dict.add_argument("--target-lang", required=True, help="目标语言代码。")

    glossary_v3_delete = subparsers.add_parser("glossary-v3-delete", help="删除 v3 glossary", description="调用 DELETE /v3/glossaries/{id} 删除词汇表。")
    add_common_options(glossary_v3_delete)
    glossary_v3_delete.add_argument("--glossary-id", required=True, help="glossary ID。")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents that it reads an API key from the environment, can read local files when explicitly requested, and sends data over the network to DeepL. However, the manifest declares no explicit tool scope or permissions, so the runtime/platform cannot enforce those boundaries declaratively. This creates a permission-model gap: even if the prose says access is limited, the lack of formal scope increases the risk of overbroad execution or reviewer misunderstanding.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest says to use "$deepL-translate" for multiple broad tasks including translation, polishing, document translation, and glossary management, but it does not define when this skill should or should not be invoked beyond that single sentence. In a manifest file, this lack of trigger specificity or negative examples can lead to unintended activation for general language-help requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The parser rewrites help output into Chinese and the rest of the CLI strings are also Chinese-only, which imposes a specific locale on all users. The file does not offer a locale option or indicate that this is intentionally limited to a Chinese-speaking environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This tool transmits user-supplied text and documents to an external third-party service, which can expose sensitive, proprietary, or regulated data if users are unaware of the disclosure. In the context of a translation skill, outbound transfer is expected, but the absence of an explicit warning or consent mechanism increases the risk of accidental data leakage.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/deepl_translate.py (reported line 391)May include surrounding context.

python
("splitting_tags", "splitting_tags"),
        ("ignore_tags", "ignore_tags"),
    ]:
        value = getattr(args, list_name, None)
        if value:
            payload[api_name] = value
    return payload

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The document download path writes data directly to a user-specified local file, which can overwrite existing files or create new artifacts without an explicit warning. While this is core expected behavior for a download command, lack of disclosure and overwrite safeguards can still lead to accidental local data loss or unintended filesystem modification.

Content

No source excerpt is available for this finding.