Subtitle Translator - MCB AI

• Outcome: Pass
• Latest audit: May 28, 2026 at 7:55 AM UTC
• Version:
  1.0.0

Overview

This skill appears to be a normal subtitle translation helper that reads user-provided SRT files and writes a translated SRT output without hidden persistence, credential access, or unrelated behavior.

Before installing, consider whether the subtitle content is private, because translation may involve your configured AI provider. Check the output filename and location before running it on important files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill indicates file read/write capabilities while declaring no permissions, which creates a transparency and policy-enforcement gap. Even if the intended functionality legitimately needs filesystem access for SRT input/output, undeclared capabilities can bypass user expectations and weaken review controls around what the skill is allowed to access or modify.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior claims AI-based subtitle translation with batching, but the analyzed behavior instead parses, decodes, and rebuilds subtitle data without performing translation. This mismatch is dangerous because users and reviewers may authorize the skill under false assumptions, while hidden or undocumented processing paths can conceal unsafe file handling, data transformation, or future payload changes.

VirusTotal

No VirusTotal findings