ClawHub
Back to skill

Security audit

multi-platform-translator

Security checks across malware telemetry and agentic risk

Overview

This translation skill is purpose-aligned, but it gives users a misleading privacy claim while submitting their text to outside translation and chat services.

Review before installing. Do not use this skill for secrets, regulated data, internal business documents, contracts, or legal text unless you are comfortable sending that text to the selected translation provider or logged-in chat service. Prefer explicit provider selection and consent before each translation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The documentation states that translation content 'will not be uploaded to third-party services,' but the skill explicitly automates submission of user text to external websites such as xfyun, DeepL, Doubao, Yuanbao, and Iciba. This is a material misrepresentation of data flow that can cause users to disclose sensitive or regulated content under false privacy assumptions.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger conditions are very broad, matching generic requests such as 'translate,' 'English-to-Chinese,' or 'Chinese-to-English' without strong exclusion boundaries or confirmation requirements. This increases the chance the skill activates on sensitive text by default and sends content to external services when the user may not expect browser automation or third-party processing.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill describes operational steps for multiple third-party translation and chat platforms but does not provide an adequate upfront warning that user text will be transmitted to those external services. Lack of clear notice undermines informed consent and creates privacy, compliance, and confidentiality risk, especially when chat-based engines may retain or further process submitted text.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.