Security audit

妙言小智(PicTech.cc)-跨境电商图片翻译

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for image translation, but it handles API keys and user images in ways users should review carefully before installing.

Install only if you are comfortable sending images to the external translation provider and supplying an API key. Prefer a version that uses environment variables or a secure credential store, documents where keys are saved and how to delete them, validates image URLs, limits file sizes, and asks before uploading sensitive images.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The code fetches attacker-controlled URLs and writes the response to a local temporary file without restricting scheme, host, content type, or size. In a skill that processes images, this creates SSRF and unsafe file-ingestion risk because an attacker could supply internal network URLs or non-image payloads that get stored and potentially processed downstream.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The helper performs unrestricted remote fetching that is broader than the stated image-translation purpose and accepts arbitrary URLs as input. In context, image translation may legitimately need downloads, but the lack of URL and payload validation makes the capability more dangerous because it can be abused to access internal resources or download unexpected content.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly promotes persistent local storage of the API key ('输入一次，永久记住') without a prominent warning about secret sensitivity, retention, theft, backup leakage, or multi-user device exposure. Storing credentials long-term is not inherently unsafe, but documenting it as a convenience feature without secure-storage details or consent materially increases the risk of secret compromise.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The quick-start example instructs users to paste a live VK secret directly into the chat conversation. Secrets entered into agent chats may be logged, retained in conversation history, exposed to plugins/tools, or leaked via screenshots and shared transcripts, making this a real secret-handling weakness.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill uploads user-supplied image content to a third-party service at stableai.com.cn via axios.post, but this file provides no user-facing disclosure, confirmation step, or privacy warning before transmission. Because images may contain sensitive commercial, personal, or embedded metadata, silent exfiltration to an external service is a real privacy/security issue even if it is part of the advertised functionality.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The README combines two risky practices: instructing users to provide an API key to the assistant and stating the skill will remember it permanently. In an agent ecosystem, this is more dangerous because chat content and locally saved secrets may both be accessible through logs, history, shared workspaces, backups, or weakly protected config files.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The example prompt directly asks the user to paste their VK secret into the conversation. This normalizes insecure secret sharing and can lead to credential exposure through model/provider logs, chat transcripts, team-visible sessions, or downstream tool invocation chains.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The parameter description says the API key will be automatically remembered after first successful run, but provides no security properties for that storage. Automatic persistence of secrets without transparency or safeguards increases the chance of unauthorized reuse, theft from disk, or accidental disclosure from local files and backups.

Static analysis

No suspicious patterns detected.