Google Cloud Translate Pro

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.0

Overview

This translation skill is user-directed and appears functional, but it is marketed as Google Cloud Translate while routing text and API credentials to SocketsIO.

Install only if you are comfortable treating this as a SocketsIO-backed remote translation tool, not a direct Google Cloud Translation integration. Use a dedicated API key and unique password, review SocketsIO privacy and pricing terms, and avoid sending secrets, regulated data, or confidential business text unless that provider is approved for your use case.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill requires environment-variable access for an API key and performs network calls, but these capabilities are not explicitly declared. This reduces transparency for users and agents, making it easier for sensitive text and credentials to be transmitted off-platform without clear permission boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill markets itself as using Google Cloud Translation with 'zero-config setup,' but the examples actually route data to SocketsIO endpoints and require a SocketsIO API key. This misrepresentation can cause users to send sensitive text to an unexpected third party under false assumptions about provider trust, compliance, and data handling.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill advertises Google Cloud Translation, but the implementation actually sends data to SocketsIO and requires a different API key. This mismatch can mislead users about where their text is sent, what vendor processes it, and which credentials they are expected to provide.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The user-facing description repeatedly claims Google Cloud Translation while the code is a wrapper around SocketsIO endpoints. In a skill context, this is security-relevant because users may disclose sensitive text or supply credentials under false assumptions about the receiving service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill encourages sending arbitrary user-provided text to an external translation API but provides no warning about privacy, retention, third-party processing, or suitability for sensitive data. In agent contexts, users may submit secrets, PII, regulated data, or internal documents, creating meaningful confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script transmits user-supplied text to a remote service and includes an API key in the request headers, but it does not clearly disclose this outbound data flow at execution time. Because this is a translation skill that may receive sensitive content, the context increases risk: users may paste confidential text believing it is handled locally or by Google when it is actually sent to another vendor.

External Transmission

Medium

• Category: Data Exfiltration

Content

Get a free API key (500K credits, never expire):

```bash
curl -X POST https://api.socketsio.com/auth/signup \
  -H "Content-Type: application/json" \
  -d '{"email":"[e-mail]","password":"yourpassword"}'
```

• Confidence: 89% confidence
• Finding: curl -X POST https://api.socketsio.com/auth/signup \ -H "Content-Type: application/json" \ -d '{"email":"[e-mail]","password":"yourpassword"}' ``` Set your key: ```bash export SOCKETSIO_A

External Transmission

Medium

• Category: Data Exfiltration

Content

Get a free API key (500K credits, never expire):

```bash
curl -X POST https://api.socketsio.com/auth/signup \
  -H "Content-Type: application/json" \
  -d '{"email":"[e-mail]","password":"yourpassword"}'
```

• Confidence: 89% confidence
• Finding: https://api.socketsio.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

Translate text to any of 195 languages. Auto-detects source language.

```bash
curl -X POST https://api.socketsio.com/v1/translate \
  -H "X-API-Key: $SOCKETSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"q": "Hello, how are you?", "target": "zh"}'

• Confidence: 92% confidence
• Finding: https://api.socketsio.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

Identify the language of any text with confidence score.

```bash
curl -X POST https://api.socketsio.com/v1/detect \
  -H "X-API-Key: $SOCKETSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"q": "Bonjour le monde"}'

• Confidence: 87% confidence
• Finding: https://api.socketsio.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

Translate up to 128 texts in a single call.

```bash
curl -X POST https://api.socketsio.com/v1/translate \
  -H "X-API-Key: $SOCKETSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"q": ["Hello", "Goodbye", "Thank you"], "target": "es"}'

• Confidence: 90% confidence
• Finding: https://api.socketsio.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

# url = "https://translation.googleapis.com/language/translate/v2"

# After (SocketsIO, $0.50/M chars):
url = "https://api.socketsio.com/v1/translate"
```

Same request format, same response format, 97% cheaper.

• Confidence: 90% confidence
• Finding: https://api.socketsio.com/

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.