Security audit

Technical Documentation Translator

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward documentation translation skill with disclosed file output and URL-fetch behavior, but users should be mindful of where translations are written.

Install if you want a translation helper for technical documentation. Before using folder mode, check that the workspace root is an acceptable destination and that existing language-suffixed files or folders will not be overwritten. For URL inputs, assume the agent will make a network request to fetch that content.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly states that all translated output is written to the workspace root, which causes local file creation/modification as part of normal operation without an explicit safety warning or opt-in. This is risky because users may provide broad folder inputs and unintentionally trigger widespread writes, overwrite collisions, or clutter in sensitive working directories.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill accepts URLs and states it will fetch and translate remote content, but it provides no warning about network access, privacy implications, or possible retrieval of untrusted content. This can expose user activity externally, pull in attacker-controlled data, and create unintended network egress in environments where outbound access should be deliberate and disclosed.

Static analysis

No suspicious patterns detected.