ClawHub
Back to skill

Security audit

Translatepro

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent translation skill, but it needs review because it encourages sending content to outside services and retaining translation memory without clear privacy, retention, or credential controls.

Before installing, assume text submitted for translation may be sent to Google, DeepL, Slack, CMS tools, or other configured services, and may be cached locally in translation memory. Avoid using it for personal, regulated, legal, medical, or proprietary content unless provider terms, encryption, retention, and deletion controls are acceptable. Prefer environment or secret-manager handling for API keys, restrict key permissions and quotas, and avoid passing keys on the command line.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:225
Finding

API Credential Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:225
Vulnerability Type: API credential exposure through process arguments
Risk Level: Medium

Vulnerable Code:

bash
claw test-skill translatepro --api-key $GOOGLE_TRANSLATE_API_KEY

Technical Analysis

The documented command expands GOOGLE_TRANSLATE_API_KEY and passes its value through the --api-key command-line argument. This places the credential in the process argument vector.

Depending on host configuration, command-line arguments may be visible to other authorized local users, process-monitoring utilities, diagnostic systems, audit tooling, crash collectors, or command telemetry. The credential could consequently be retained in logs or observed while the command is running.

Attack Path

  1. A user exports a valid Google Translation API key as documented.
  2. The user runs the test command from SKILL.md:225.
  3. The shell expands $GOOGLE_TRANSLATE_API_KEY into its secret value.
  4. The expanded value becomes part of the claw process argument vector.
  5. A local process observer or telemetry collector captures the command line.
  6. An attacker with access to the captured data extracts and reuses the key against the Google Translation API.

Exploitation requires access to process metadata, monitoring output, or retained command telemetry; the documentation alone does not grant remote access.

Impact Assessment

Exposure may allow unauthorized use of the affected Google Translation API credential within the permissions and quotas assigned to that key. Potential consequences include fraudulent API consumption, quota exhaustion, billing charges, and disruption of legitimate translation workflows.

This issue does not directly provide operating-system privilege escalation or arbitrary code execution. Its scope is limited by the API key's configured service restrictions, application restrictions, quotas, and associated cloud permissi ...[truncated 4 chars]

Remediation
View remediation

Remediation Suggestions

  • Modify the claw command so it reads GOOGLE_TRANSLATE_API_KEY directly from the environment without accepting the secret as a command-line argument.
  • Alternatively, accept the key through standard input or a permission-restricted secret file.
  • Avoid printing, logging, or including credential values in diagnostic output.
  • Configure Google Cloud API-key restrictions, including limiting the key to the Translation API and applying applicable application restrictions.
  • Apply conservative quotas and billing alerts to reduce the impact of credential misuse.
  • Rotate the key if the documented command has already been used in an environment where process arguments or command telemetry may have been retained.
  • Replace the vulnerable example with a command that does not expand secrets into the argument vector.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
EEPL_API_KEY"],"bins":["curl","jq"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"🌍"}}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

Step 1: Get API Keys

Step 2: Prepare Translation Memory (Optional)

bash

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The phrase "Use when the user needs multilingual content, website localization, or global campaign adaptation for any industry" is very broad and does not define clear trigger boundaries or exclusions. Because this is a markdown/manifest-style description, the lack of narrower scope or negative examples increases the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs users to send content to external translation APIs and optionally webhook destinations, but it does not prominently warn that source text may leave the local environment and be processed by third parties. This omission is dangerous because users may submit confidential, regulated, or proprietary material without understanding the privacy and data-sharing implications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The skill encourages storing translation memory files under a persistent directory in the user's home folder. Translation memories often contain prior source and translated text, which may include proprietary or personal data; persistent local storage increases the chance of unintended retention, backup exposure, cross-project leakage, or later reuse in unsafe contexts.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

bash
# Export from existing CAT tools (Trados, memoQ, SDL)
# Save as TMX or XLIFF format
mkdir -p ~/.translatepro/memories/
cp your-glossary.tmx ~/.translatepro/memories/

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill claims it will not store PII, but earlier sections state that every translation can be added to translation memory and cached for reuse. If users submit content containing personal or regulated data, that data may be retained locally or operationally despite the safety claim, creating a misleading privacy guarantee and increasing risk of unauthorized retention.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.