Security audit

翻译

Security checks for vulnerabilities and agentic risk

Overview

This looks like a translation skill, but it asks for command execution and includes broad automation and messaging claims that do not fit that purpose.

Install only if you are comfortable with a translation skill that declares read, write, and exec access and has poorly scoped automation language. Prefer a version that removes exec, deletes unrelated messaging/workflow claims, and limits activation to explicit Chinese-English translation requests.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as a translation tool, but the documentation also describes generic workflow/DAG execution, branching, retries, and report/log generation. This capability mismatch can cause an agent to grant the skill broader authority or invoke it in unintended automation contexts, increasing the chance of unsafe behavior and user confusion.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The premium-feature table advertises bulk messaging, template injection, callbacks, archival, and rate control, which are unrelated to translation. Such misleading capability claims can cause inappropriate invocation or normalization of messaging behaviors that may involve data handling or outbound communication beyond user expectations.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: A translation skill declaring exec capability is over-privileged, especially when the document also references command-execution risk controls. Even without explicit exploit code, unnecessary execution privileges expand attack surface and make prompt-induced shell actions more plausible in a context that should only require text processing.

Vague Triggers

High

Confidence: 94% confidence
Finding: The activation text is overly broad and frames the skill as usable for general efficiency, automation, batch processing, and workflow optimization. This can cause the agent to select the skill for tasks unrelated to translation, potentially exposing exec/read/write capabilities in situations where the user never requested such broad automation.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The example trigger says to act whenever the user mentions a translation need, which is ambiguous and encourages automatic invocation without clear confirmation. In an agent setting, loose triggers can misfire on contextual discussion, quoted text, or mixed-intent requests, leading to unintended actions or output transformations.

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: The instruction to directly return translation results without extra clarification can override user preferences about target language, formatting, or whether translation is desired at all. In multilingual contexts, this may cause silent transformation of content, reduce transparency, and conflict with the user's locale or workflow expectations.

Static analysis

No suspicious patterns detected.