Security audit

Epub Translator

Security checks for vulnerabilities and agentic risk

Overview

This EPUB translator is purpose-aligned, but it includes a bundled API key and can send book contents to a remote service and delete user-selected work directories without strong safeguards.

Review before installing. Do not use the bundled API key; rotate it if you own it and replace it with your own environment-provided credential. Only run this on documents you are willing to send to the configured provider, verify the base_url, avoid shared work directories, and do not pass valuable existing folders to --work-dir.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: assets/config.json:3
Finding: Hardcoded API Credential Committed in Configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: assets/translate_epub.py:190
Finding: EPUB Contents Are Transmitted Without an Enforced Consent Gate
Content: View full analysis
str: """Single translation request with exponential-backoff retries.""" backoff = 2.0 last_err: Optional[Exception] = None model_name = str(CONFIG["model_name"]) system_prompt = str(CONFIG.get("system_prompt", "")) extra_body = CONFIG.get("extra_body") or {} for attempt in range(max_retry): try: kwargs = dict( model=model_name, messages=[ {"role": "system", "content": system_prompt}, {"role": "user", "content": text}, ], stream=False, ) if extra_body: kwargs["extra_body"] = extra_body resp = _client().chat.completions.create(**kwargs) out = (resp.choices[0].message.content or "").strip() if out: return out except Exception as e: last_err = e time.sleep(backoff) backoff *= 2 ``` The main workflow submits all extracted text to this function: ```python if todo: print(f"[PHASE 2] Global parallel translation (concurrency={args.concurrency}) ...") translate_batch(global_unique, concurrency=args.concurrency) ``` ### Technical Analysis Cloud-based translation inherently requires network transmission, so network access is related to the declared functionality. However, the Skill documentation states that network access is off by default and remote access requires explicit user approval. The executable implementation does not enforce that policy. Running the documented command automatically: 1. Extrac ...[truncated 1876 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: assets/translate_epub.py:690
Finding: Arbitrary Recursive Deletion Through the Work Directory Argument
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: assets/translate_epub.py:229
Finding: Source Document Contents Persist in a Plaintext Cache
Content: View full analysis
None: if CACHE_PATH is None: return with CACHE_LOCK: snapshot = dict(CACHE) tmp = CACHE_PATH.with_suffix(".json.tmp") tmp.write_text( json.dumps(snapshot, ensure_ascii=False, indent=2), encoding="utf-8", ) tmp.replace(CACHE_PATH) ``` The cache is placed in a persistent work directory: ```python global CACHE_PATH CACHE_PATH = work_dir / "cache.json" load_cache(args.resume) ``` The cache dictionary uses original source text as keys and translated text as values: ```python CACHE[text] = zh ``` ### Technical Analysis The translation cache serializes original EPUB excerpts and their translations into a human-readable JSON file. The default work directory is created beneath the current directory, and the main workflow does not remove the cache or extraction directory after completion. No explicit restrictive file permissions are applied. Consequently, the resulting permissions depend on the platform, parent directory, and process umask. On shared systems or shared workspaces, other users or processes may be able to read the cache. The documentation describes resume caching but does not provide a no-cache mode, retention period, cleanup policy, or explicit consent mechanism for persistent plaintext storage. ### Attack Path 1. A user translates an EPUB containing private or sensitive material. 2. The script records source paragraphs and translations in `cache.json`. 3. The work directory remains on disk after the output EPUB is generated. 4. Another user, process, backup system, synchronization client, or later workspace consumer accesses the directory. 5. The party reads the original and translate ...[truncated 779 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 79% confidence
Finding: The skill is designed to send EPUB text to a remote OpenAI-compatible API for translation, which is an external data transmission risk because book contents may include sensitive or copyrighted material. Although the skill explicitly says network access is off by default and requires user approval, once approved it can transmit substantial document content to third-party services, so the finding is contextually real but partially mitigated.
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
- `base_url`：服务根地址（**不含 `/chat/completions`**）。脚本会自动剥掉末尾的 `/chat/completions` 与多余斜杠。例： - DeepSeek 官方：`https://api.deepseek.com` - OpenCode 网关：`https://opencode.ai/zen/go/v1` - OpenAI 官方：`https://api.openai.com/v1` - 通义千问兼容模式：`https://dashscope.aliyuncs.com/compatible-mode/v1` - 智谱：`https://open.bigmodel.cn/api/paas/v4` - `extra_body`：附加请求体。DeepSeek 关闭推理：`{"thinking": {"type": "disabled"}}`，其它模型一般留空 `{}`。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The system prompt explicitly requires translating content into Simplified Chinese and only outputting that language, without offering the user any locale or language choice. This is a natural-language policy issue because the skill enforces a specific language behavior globally rather than making it optional or context-dependent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest presents the skill as operating on a user-provided EPUB file, but the safety section explicitly discusses optional network access and the input section allows remote URL/repository fetching. While model API access for translation is expected, fetching arbitrary remote resources is an additional behavior not conveyed in the manifest description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill for translating English EPUB files, but the documentation says it also accepts Markdown/TXT, JSON-structured data, direct chat context, and URLs/repository addresses. That expands the skill from an EPUB translator into a more general content-ingestion and remote-fetch translation tool, which does not match the stated manifest scope.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The skill is designed to send book content to third-party OpenAI-compatible endpoints for translation, which is an external transmission of potentially sensitive user-supplied material. Even though the document says network access requires explicit user consent, the core workflow still involves bulk content exfiltration to external services once enabled, creating confidentiality and data-handling risk.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 93)May include surrounding context.
md
- `base_url`：服务根地址（**不含 `/chat/completions`**）。脚本会自动剥掉末尾的 `/chat/completions` 与多余斜杠。例： - DeepSeek 官方：`https://api.deepseek.com` - OpenCode 网关：`https://opencode.ai/zen/go/v1` - OpenAI 官方：`https://api.openai.com/v1` - 通义千问兼容模式：`https://dashscope.aliyuncs.com/compatible-mode/v1` - 智谱：`https://open.bigmodel.cn/api/paas/v4` - `extra_body`：附加请求体。DeepSeek 关闭推理：`{"thinking": {"type": "disabled"}}`，其它模型一般留空 `{}`。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The system prompt explicitly requires translating content into Simplified Chinese and outputting only that form, with no opt-in or alternative locale choice. This is a natural-language locale policy constraint that applies broadly across the skill rather than being presented as a user-selectable preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The system prompt explicitly instructs the skill to translate into Simplified Chinese and to output only that translation. This imposes a fixed language/locale behavior without offering the user a choice or documenting an opt-in, which matches the policy-violation category for language constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file description and default system prompt hard-code an English-to-Chinese translation workflow, and the prompt instructs the model to output only Chinese. This is a natural-language locale constraint without any user opt-in or explanation that the skill is intentionally region- or language-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script extracts text from user-provided EPUB files and sends that content to a remote LLM API via chat.completions.create, but it does not provide any explicit user-facing warning, consent gate, or data-handling notice in the CLI flow. EPUBs can contain proprietary, personal, or otherwise sensitive material, so silent transmission to a third-party service creates a real confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The default prompt explicitly defines the assistant as an English-to-Chinese translator and instructs it to output only the translation. This enforces a specific language policy in natural language rather than offering the user a choice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The safety declaration states the skill will not auto-install dependencies and should stop when dependencies are missing. Elsewhere, the workflow says EPUB extraction may use 'unzip / Python zipfile', implying reliance on external tools, but does not reconcile whether invoking such host tools is allowed under the stated failure-only posture.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file is dedicated to translated-zh styling and includes Chinese-language comments and Chinese-specific font choices, which suggests the skill may enforce a Chinese locale or translation variant. Under the policy rule, locale-specific behavior should either offer user choice or be clearly documented as justified; this file alone provides no such indication.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.