ClawHub
Back to skill

Security audit

Ollang SKILLS

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Ollang API skill, but it needs Review because broad activation wording can lead to authenticated external uploads, paid orders, and account changes without consistent confirmation gates.

Install only if you intend your agent to use Ollang for translation workflows. Review files before upload, treat order creation, rerun, QC, and human review as potentially billable account actions, avoid using generic translation prompts unless you mean Ollang, and prefer a pinned or manually reviewed installation source.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:13
Finding

Unpinned Package Execution and Mutable Skill Source During Installation

Content
View full analysis

Vulnerability Details

File Location: README.md:13-15
Vulnerability Type: Unpinned third-party package execution and mutable source installation
Risk Level: Medium

Vulnerable Code

bash
npx skills add https://github.com/ollang/skills --skill ollang

Technical Analysis

The installation command invokes the skills npm package through npx without specifying an exact package version. Depending on the local environment and cache state, npx can retrieve and execute the package currently published under that name. The executed installation package is therefore not cryptographically tied to the version reviewed during this audit.

The Git repository is also referenced without an immutable commit hash or signed release identifier. Its contents can change after review, meaning a later installation may receive Skill instructions that differ from the audited files.

This behavior creates a supply-chain trust gap. The command does not itself prove that either upstream source is malicious, but compromise of the npm package, publisher account, repository, or associated release process could turn the documented installation path into a remote code or malicious-Skill delivery mechanism.

Attack Path

  1. An attacker compromises the unpinned skills npm package, its publisher account, or another component involved in resolving the package.
  2. Alternatively, the attacker gains control of the referenced Git repository or modifies its default branch through a compromised maintainer account.
  3. The attacker publishes malicious package logic or replaces the repository's Skill content.
  4. A user runs the documented npx skills add ... command.
  5. npx resolves and executes the package version available at installation time, which then consumes the mutable repository source.
  6. The altered installer executes with the user's local privileges, or the altered Skill is installed and later influences an agent whe ...[truncated 764 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the npm installer to an exact reviewed version, for example:
    bash
    npx --yes skills@X.Y.Z add https://github.com/ollang/skills.git#REVIEWED_COMMIT --skill ollang
  2. Replace REVIEWED_COMMIT with a full immutable Git commit hash rather than a branch or mutable tag.
  3. Publish signed releases and document how users can verify the release signature and commit identity.
  4. Supply integrity hashes for downloadable release archives and require verification before installation.
  5. Prefer a reviewed local or vendored installer where practical, rather than executing a package fetched at installation time.
  6. Recommend installation from a dedicated low-privilege account or isolated environment. Explicitly warn users not to run the command with sudo or administrative privileges.
  7. Add dependency provenance monitoring and release controls, including multi-factor authentication, protected branches, mandatory review, and restricted npm publishing rights.
  8. Retain the manual installation option, but direct users to a versioned, signed release archive instead of the repository's mutable default branch.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The installation command uses npx skills without pinning an exact package version. That allows whatever version is current at install time to run on the user's machine, increasing supply-chain risk if the package is compromised or a breaking/malicious release is published.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md
That's it — the skills are now available in your agent.

**Manual installation:** copy the skill folders into your agent's skills directory (e.g. `~/.claude/skills/` for Claude Code). For Cursor or other agents, refer to your agent's documentation.

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README promotes upload and order-creation actions that transmit files and account-associated data to an external API, but it does not warn users about that data flow. In agent settings, missing disclosure can lead users to unintentionally send sensitive files or metadata off-platform.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger example "show recent translations" is broad everyday language and could overlap with general conversational requests rather than clearly indicating the specific ollang-orders-list skill. The README does not provide exclusion conditions or tighter scope for when this phrase should or should not activate the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description is broad enough to match generic translation or captioning requests, not just explicit Ollang-related intents. That can cause unintended routing into a skill that assumes Ollang workflows and credentials, leading to overbroad activation, user confusion, and accidental disclosure or use of Ollang-specific operations in unrelated contexts.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This skill performs an intentional external transmission to Ollang's API, including project identifiers and order details, which may correspond to sensitive user content or trigger paid processing. While expected for the skill's purpose, it still represents a real data-exfiltration and external-action surface if invoked without sufficient user awareness and consent.

Content

Scanner excerpt · ollang-order-create/SKILL.md (reported line 58)May include surrounding context.

Example (curl)

bash
curl -X POST https://api-integration.ollang.com/integration/order/create \
  -H "X-Api-Key: $OLLANG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to create a remote order and transmit project-related data to an external API without an explicit user-facing warning or confirmation step at the point of action. This is dangerous because users may not realize their files/project metadata are being sent to a third-party service and may incur costs or disclose sensitive content unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the agent to fetch and display full order details, document download URLs, and QC evaluation content without any user-facing warning about the sensitivity of that data. In a translation platform context, order metadata, file URLs, and evaluation details may expose confidential customer content, internal workflow status, or direct-access links that could be unintentionally revealed in chat transcripts or to the wrong user.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ollang-order-rerun/SKILL.md (reported line 37)May include surrounding context.

Example (curl)

bash
curl -X POST https://api-integration.ollang.com/integration/orders/ORDER_ID/rerun \
  -H "X-Api-Key: $OLLANG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to submit QC jobs to an external Ollang API but does not clearly warn that order content and related translation data will be transmitted off-platform for evaluation. It also omits a privacy warning around the optional callbackUrl, which could expose evaluation results or metadata to a third-party endpoint if misconfigured.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The example shows a POST request to an external Ollang endpoint that triggers processing of order data, which inherently involves external transmission of potentially sensitive translation content. In this skill context the transmission is expected functionality, but it is still security-relevant because users may unknowingly send confidential material and optionally direct results to a callback URL they control or misconfigure.

Content

Scanner excerpt · ollang-qc-eval/SKILL.md (reported line 61)May include surrounding context.

Example (curl)

bash
# Full evaluation with all metrics
curl -X POST https://api-integration.ollang.com/integration/orders/ORDER_ID/qc \
  -H "X-Api-Key: $OLLANG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ollang-revision/SKILL.md (reported line 54)May include surrounding context.

Example

bash
curl -X POST https://api-integration.ollang.com/integration/revision/ORDER_ID \
  -H "X-Api-Key: $OLLANG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to upload user-provided files to a third-party API but does not require an explicit user warning or confirmation about external data transmission, privacy implications, or the sensitivity of the uploaded content. This creates a real risk of unintentionally sending confidential documents, media, or subtitles off-platform without adequately informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The phrase "find folder ID" is underspecified and may match common file-management requests unrelated to the Ollang platform. Because the trigger list lacks context boundaries or negative examples, agents may invoke the skill outside the intended Ollang-specific workflow.

Content

No source excerpt is available for this finding.