Security audit

translate-polish

Security checks for vulnerabilities and agentic risk

Overview

This translation skill is coherent and disclosed, but users should be aware that its optional learning helper can save local notes and preferences across sessions.

Install only if you are comfortable with a translation helper that may create learned_patterns.json when its learner script is used. Do not put confidential source text, personal data, contracts, or medical/legal details into learner notes or preferences; delete the JSON file if you do not want retained local history.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation references scripts that read and write local files, but the skill declares no corresponding permissions or capability boundaries. This creates a transparency and governance gap: users and hosting platforms may invoke the skill without realizing it can persist data or inspect files, increasing the risk of unintended data exposure or unauthorized state changes.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The advertised purpose is translation and polishing, but the documented behavior extends into persistent task logging, preference capture, generic insight generation, and self-reflection over arbitrary skills. That mismatch is dangerous because users may provide sensitive text for translation without understanding it could be retained and analyzed beyond the immediate task, violating least surprise and potentially leaking confidential information.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: A persistent self-learning and task-logging subsystem is outside the narrow scope of a translation workflow and introduces data retention not obviously required for the task. In the context of translation, users often submit contracts, medical text, business correspondence, or other sensitive material, so storing lessons and notes across sessions materially increases confidentiality risk.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Recording task outcomes, error types, and free-form notes to learned_patterns.json is not clearly necessary for producing a translation and can capture sensitive user context or business details in durable storage. Because the notes are free-form, operators may inadvertently persist confidential content, legal terms, or personal data that would otherwise remain ephemeral.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This file implements a generic cross-skill telemetry and self-learning module that is broader than the advertised translation/polishing function. In a skill context, unrelated persistent behavior increases data collection scope and attack surface, especially because it can be invoked against arbitrary skill directories rather than being tightly scoped to this translation skill.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code persistently records arbitrary user preferences, capability usage, notes, and error history to disk without any apparent necessity for translation output. Because notes and preferences may contain sensitive user or business information, this creates unjustified retention and cross-session profiling risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The write path persists behavioral and preference data to a JSON file with no nearby disclosure, consent flow, or safeguards. In this skill context, silent persistence is dangerous because users invoking a translation tool would not reasonably expect hidden telemetry/state files to be written, increasing privacy and compliance risk.

Static analysis

No suspicious patterns detected.