微信小游戏本地化Skill

• Outcome: Review
• Latest audit: May 28, 2026 · 8:22 AM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate mini-game localization skill, but it can persist credentials, upload project images externally, install dependencies, and automatically rewrite project source files, so it needs human review before installation.

Install only on a clean branch and only if you are comfortable with a tool that can modify source files and assets, install npm dependencies, read or store MCP tokens in IDE configs, and upload game images to an external service. Prefer explicit credentials over auto-discovery, avoid writing tokens into multiple IDE configs, skip image translation for sensitive assets, and review generated plans and diffs before allowing the automatic replacement stages.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The document first states that AI must not directly edit source and should rely on controlled scripts, but later mandates manual AI edits as a fallback for failed replacements. This inconsistency undermines the safety model, bypasses scripted validation/rollback guarantees, and creates a path for unreviewed source changes.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The document sets a safety boundary that AI must not directly modify source files, then later introduces a conflicting fallback that requires manual edits via `replace_in_file`. This contradiction can cause an agent to bypass the script-only control path, resulting in unsupervised source modification, inconsistent rollback behavior, and accidental corruption of project code.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The key notes reaffirm that all replacement operations must be script-driven, but the procedure elsewhere instructs the AI to manually patch failures. Such policy inconsistency is dangerous because agents may follow the more permissive path and directly alter project files outside the documented safety guarantees.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to inspect the user's environment and write MCP credentials into IDE-specific files under the home directory, which exceeds the stated localization purpose and expands access across the user's system. This broad configuration behavior can expose sensitive tokens, create unintended persistence, and modify tools unrelated to the immediate task without clear necessity or consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Recommending writes to all installed IDEs unnecessarily broadens the blast radius of a single translation task into multi-environment persistence. If followed, the agent could propagate credentials and remote service access into unrelated development tools, increasing the chance of leakage, misuse, or hard-to-audit configuration drift.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The documented flow directs the agent to execute a local Node.js script that reads credential-bearing IDE configs, packages local files, and performs network upload. Even if intended for functionality, this combines local file access, credential use, archive creation, and outbound transfer in a way that materially exceeds a narrow translation skill and increases the risk of unintended data exfiltration or unsafe workspace actions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs running `npm install` in the skill's `scripts/` directory before scanning. That introduces code execution and possible network/package retrieval beyond passive file analysis, and exposes users to dependency-supply-chain risk if the skill or its dependencies are compromised. In a scanning/localization workflow, requiring package installation is a meaningful expansion of capability and trust.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs uploading all project images to an external MCP OCR service, including a full-image collection step with minimal filtering. This creates a clear exfiltration path for potentially sensitive project assets, and the instruction to upload everything before filtering for Chinese text increases unnecessary data exposure. Because the skill operates on source projects, images may contain unreleased content, credentials in screenshots, branding, or proprietary art.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This is a true vulnerability because the script does more than generate artifacts: it also writes files into the target project and later triggers automated deployment/injection behavior. In a build or CI context, a user invoking a 'langpack generator' would not reasonably expect project source mutation, which creates a supply-chain style integrity risk and can silently alter application behavior.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code rewrites entry files by searching the project and injecting import/init statements based on heuristics. Automatic source modification is dangerous because it can corrupt entrypoints, introduce malicious or unintended runtime behavior, and bypass normal code review expectations for a localization utility.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The header and usage text describe a language-pack generator, but the implementation also deploys files and edits project code. That mismatch is security-relevant because it conceals side effects from operators and reviewers, increasing the chance the script is run with trust it has not earned.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script explicitly adds the target project's node_modules into its module resolution path and then require()s parser packages from there. In Node.js, requiring a package executes its top-level code immediately, so scanning an untrusted project can run attacker-controlled code during dependency loading, turning a passive text scan into arbitrary code execution in the analyst's environment.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script searches multiple project- and user-level IDE configuration directories in the home folder and automatically extracts MCP URL, APPID, and TOKEN values. That behavior expands access beyond the immediate project context and creates credential-harvesting capability if the script is run in an untrusted repository or modified skill, especially because the same credentials are then used for outbound network requests.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger criteria are extremely broad and include vague phrases like a game being used overseas, causing the skill to activate in ambiguous situations. Because this skill can write files, install dependencies, read config, and upload assets, accidental invocation materially increases the risk of unintended project modification or external data disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The workflow writes configuration files, modifies project source/resources, injects code, and may replace compiled artifacts, but these destructive or persistent actions are not clearly front-loaded in the skill description. Users may reasonably expect translation guidance, not immediate project mutation, which weakens informed consent and increases the chance of surprising changes to valuable codebases.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill describes automatic deployment of language packs, initialization-code injection, and text/image replacement without clearly warning that these actions modify application code and resources in place. In an automation context, under-disclosure of write operations increases the chance of silent, broad project changes that the user did not fully anticipate.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs the AI to perform manual source replacements for failed entries but does not clearly frame this as a high-risk direct code-editing operation. In a skill designed to act on project files, this omission makes destructive or hard-to-review edits more likely, especially because the fallback occurs after automated replacement has already partially modified the codebase.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation tells the agent to place APPID and TOKEN into local config files but does not address secure storage, permissions, masking, or lifecycle management for those secrets. Storing tokens in plaintext config under home directories can lead to credential disclosure through backups, logs, repo inclusion, or access by other local tools.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill directs downloading and extracting a server-provided zip into project directories without safeguards for overwrite, path traversal, or unexpected file contents. Because the archive originates from an external service, blindly unpacking it into the workspace could overwrite assets or place files outside the intended directory if the archive is malformed or compromised.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly directs automatic execution and automatic correction without user confirmation, including restoring files, re-running replacement, and writing reports. In an agent context, silent file modification can cause unintended data changes, overwrite user work, or trigger destructive workflows without informed consent, especially because the loop can run up to three times.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill instructs re-downloading image files from MCP when fixes are needed, but it does not warn the user about network access, external data transfer, or trust boundaries for downloaded content. In practice this can expose project metadata or assets to external services and introduce unverified files into the workspace without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script performs broad recursive directory creation and file writes into project-controlled paths without a strong upfront warning, consent barrier, or constrained output target. Even if intended for convenience, this can overwrite files, pollute repositories, and produce unreviewed source changes that are hard to detect in large projects.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script silently reads credentials from local IDE config files and transmits image data to a remote MCP endpoint over HTTP(S) without explicit disclosure or confirmation. In a skill intended for localization workflows, this is more dangerous because users may treat it as a benign translation helper while it accesses cross-tool secrets and performs network exfiltration-capable actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script builds shell command strings for PowerShell and zip using paths derived from user-controlled project input, then executes them with execSync. This creates command-injection risk if PROJECT_ROOT or generated paths contain shell-metacharacters or quoting-breaking characters, allowing arbitrary command execution under the user's account.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/replace-text.js:286

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/upload-images.js:220