Security audit

Lingvanex Translation API

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Lingvanex translation connector, with the main caution that text sent for translation or detection goes to an external service.

Install only if you are comfortable sending the text you ask to translate or detect through OOMOL's Lingvanex connector. Avoid using it on confidential, regulated, or private text unless that third-party processing is acceptable for your use case.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest claims the skill is for 'searching and reading data,' but the actual actions perform active processing via translation and language detection. This mismatch can mislead an agent or user into treating the skill as lower risk than it is, causing it to invoke external processing on user-supplied text without the scrutiny appropriate for non-read operations.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The safety section says untagged actions are 'reads,' but the untagged actions here invoke external computation on submitted text rather than merely retrieving existing data. That unsafe categorization may cause automated agents to run translation or language detection without confirmation or sensitivity checks, increasing the risk of unintended disclosure of confidential text to the connector service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.