Security audit

Arxiv Translate

Security checks for vulnerabilities and agentic risk

Overview

This skill appears benign: it generates a link to a Chinese arXiv translation service, with only minor input-validation and language-usability caveats.

Before installing, understand that this skill points users to an external translation service at hjfy.top and the script should ideally reject invalid arXiv IDs instead of echoing arbitrary input. Use normal caution with links produced from untrusted arguments.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

Location: scripts/arxiv-translate.sh:27
Finding: Unvalidated Input Reflected into Terminal Output and Generated URL
Content: View full analysis
" echo "Example: arxiv-translate 2601.06798" echo "Example: arxiv-translate https://arxiv.org/abs/2601.06798" exit 1 fi ARXIV_ID=$(extract_arxiv_id "$INPUT") TRANSLATION_URL="https://hjfy.top/arxiv/${ARXIV_ID}" echo "📄 论文 ID: ${ARXIV_ID}" echo "" echo "🌐 中文翻译链接:" echo "${TRANSLATION_URL}" ``` ### Technical Analysis The extraction function returns the original argument unchanged when it does not match a recognized arXiv identifier pattern. That unchecked value is subsequently embedded in a URL and printed to the terminal. An attacker-controlled argument can contain terminal control characters, including ANSI or OSC escape sequences. A compatible terminal may interpret these sequences instead of displaying them literally. This can modify terminal presentation, hide or overwrite output, or cause a displayed hyperlink to point somewhere different from its visible text. This issue does not constitute shell command injection in the current implementation: variable expansions are quoted, and the value is not passed to `eval`, a shell interpreter, or another command-execution sink. ### Attack Path 1. An attacker supplies a crafted command-line argument containing terminal escape sequences. 2. The argument does not match any accepted arXiv identifier pattern. 3. `extract_arxiv_id` reaches its fallback branch and returns the argument unchanged. 4. The unchecked value is assigned to `ARXIV_ID` and incorporated into `TRANSLATION_URL`. 5. Both values are printed to the terminal. 6. If the terminal interprets the supplied control sequences, its visible output or hyperlink met ...[truncated 592 chars]
Remediation: View remediation
&2 return 1 fi } if ! ARXIV_ID=$(extract_arxiv_id "$INPUT"); then exit 1 fi ``` ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The user-facing output strings are entirely in Chinese, including the label for the translation link and explanatory text. This imposes a specific language on all users without offering a language/locale choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.