T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:54- Finding
Misleading Privacy Claim and Unconsented Disclosure to Multiple Translation Providers
- Content
View full analysis
- Remediation
View remediation
Security audit
multi-platform-translator
Security checks for vulnerabilities and agentic risk
Overview
This translation skill is useful in purpose, but it misleadingly says text stays local while its instructions send that text to external translation and chat services.
Review before installing. Do not use this skill for passwords, API keys, personal data, confidential business text, legal documents, or regulated material unless you are comfortable sending that text to the selected provider and possibly to fallback providers. The publisher should replace the local-only privacy claim with clear provider-by-provider disclosure and require confirmation before fallback transmission.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: multi-platform-translator version: 1.2.0 description: "Translate content across multiple platforms and languages with context-aware localization"
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill description and notes fail to provide an accurate warning that content is sent to third-party translation websites, and nearby text even implies the opposite. Because the skill is designed around external web translators and chat services, missing or misleading disclosure materially increases the risk of accidental exfiltration of confidential, personal, or proprietary text.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly automates browser interactions with external translation services such as xfyun, DeepL, Doubao, Yuanbao, and Iciba, which necessarily transmits user-provided text to third-party systems. The documentation claim that translation content 'will not be uploaded to third-party services' is therefore false and can mislead users into submitting sensitive or regulated data under incorrect privacy assumptions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger conditions include broad phrases around 'translate' and related wording, making the skill likely to activate for a wide range of user requests without adequate scoping. In this skill’s context, overbroad activation is risky because activation can cause user text to be sent to external websites, potentially exposing content the user did not intend to route through third-party services.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description states the tool supports only Chinese-English translation ("中英互译功能"), which is a natural-language locale constraint. Because the manifest text does not indicate that this limitation is optional, configurable, or justified as region-specific, it may violate language/locale policy expectations.
- Content