Subtitle Translator - MCB AI

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:09 AM UTC
• Version: 1.0.0

Overview

This is a coherent subtitle-translation helper that reads SRT files, prepares text for AI translation, and writes translated SRT output, with no hidden persistence or data exfiltration found.

Before installing, prefer a pinned ClawHub installer version instead of `@latest`, and only run the skill on subtitle files you intend the agent to read and translate. Expect it to create a new SRT output file near the input path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14
Vulnerability Type: Supply-chain risk caused by executing a mutable package version
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install subtitle-translator-mcbai

Technical Analysis

The documented installation command asks npx to retrieve and execute the version of the clawhub package currently referenced by the mutable latest distribution tag. Because this tag can be changed after the skill has been reviewed, the code executed during a future installation is not necessarily the code that existed at audit time.

The project does not include an exact package version, integrity hash, lockfile, vendored installer, or other mechanism that binds this command to a reviewed artifact. Consequently, compromise of the package publisher, registry account, release pipeline, package itself, or one of its install-time dependencies could cause the command to execute attacker-controlled code.

This finding concerns the documented installation process. The audited local Python scripts do not themselves retrieve or execute remote payloads.

Attack Path

1. An attacker compromises the clawhub publishing account, release process, package, or relevant dependency.
2. The attacker publishes a malicious release and causes the mutable latest tag to reference it.
3. A user follows the installation instruction in SKILL.md.
4. npx downloads the package selected at that time and executes it locally.
5. Malicious package or lifecycle code runs with the permissions of the user performing the installation.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting scope would depend on that account's privileges and accessible resources, potentially including:

• Reading or modifying files available to the user.
• Accessing credentials or environment data available to the installation process.
• Insta ...[truncated 387 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version:

   bash

   npx clawhub@X.Y.Z install subtitle-translator-mcbai
   

2. Verify the selected release's registry provenance, publisher identity, and integrity before documenting it.
3. Use package-manager integrity and lock mechanisms where supported so transitive dependencies are reproducible.
4. Prefer a locally installed or vendored, reviewed installer over downloading and executing an installer at invocation time.
5. Review package lifecycle scripts and the complete dependency graph before approving version updates.
6. Introduce an update process in which new versions are audited before the pinned version in SKILL.md is changed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A mismatch between the declared behavior and the actual behavior is dangerous because users and orchestrators may grant trust, trigger the skill, or expose files based on the stated purpose while the implementation does something materially different. In this context, a subtitle translator that instead parses/outputs JSON or lacks translation behavior can cause unsafe routing, unexpected data handling, and concealment of functionality that should have been reviewed separately.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill appears to read and write subtitle files but does not declare any explicit tool scope or permissions boundaries. This can lead to overbroad file access at runtime, making it harder to enforce least privilege and increasing the chance that the skill is invoked with unintended filesystem capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Overly broad activation phrases increase the chance that the skill is invoked for ordinary language requests or loosely related file-handling tasks. Because this skill can access and write files, accidental activation widens the attack surface and may expose user data or trigger unintended processing on the wrong inputs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx clawhub@latest pulls whatever version is current at install time, which creates a supply-chain risk and makes builds non-reproducible. If the upstream package or one of its dependencies is compromised, users could install and execute malicious code simply by following the documented command.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and function docstring are written in Vietnamese, and the script's user-facing stderr messages also follow that locale implicitly. This creates a language/locale constraint without documenting opt-in or offering an alternative, which matches the policy's prohibition on forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file's natural-language description and docstrings are written in Vietnamese, which imposes a specific language on maintainers or users reading the skill source. The file does not indicate that the skill is intentionally region-specific or provide any opt-in or alternative language support.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.