Security audit

Translate Hub Free

Security checks for vulnerabilities and agentic risk

Overview

This looks like a translation skill, but it asks for command execution without explaining why, so users should review it before installing.

Install only if you are comfortable giving this translator command-execution permission. For normal translation, prefer a version that removes exec, narrows the instructions to in-memory translation, and warns users before submitting confidential code, documents, credentials, or regulated data to an LLM-backed workflow.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as a translation-only tool, but the documented use of generic `input_params` with create/query/export operations expands the apparent capability boundary beyond translation. This ambiguity can mislead an agent into invoking broader actions than users expect, increasing the risk of unintended data handling or abuse through overly permissive orchestration.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: Allowing code-comment translation to be described with create/query/export semantics is inconsistent with the claimed purpose and may cause an agent to treat source code inputs as objects to manipulate or export rather than text to translate. In a code-handling context, this broadening is more dangerous because it can enable unintended file or content operations on sensitive source material.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The terminology/Markdown capability similarly introduces create/query/export operations that do not match a translation-only manifest, creating a mismatch between declared and effective scope. Because Markdown and terminology inputs often include internal documentation, this ambiguity raises the chance of over-collection, retention, or export of sensitive content under the guise of formatting or terminology support.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The manifest requests `exec` even though the documented function is translation, and no necessary execution workflow is substantiated. Unnecessary command-execution capability materially increases risk because any prompt injection, skill confusion, or future extension could leverage shell access to read files, exfiltrate data, or run arbitrary commands far outside the user’s expectation of a translator.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation explicitly classifies the skill as MD+EXEC and states that some functionality requires command execution, but it never explains what commands are run or why. This makes the skill more dangerous in context because users are likely to submit code, documents, and proprietary text to a translator, while hidden or unjustified execution capability could be abused against those same sensitive inputs or the host environment.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation scope is overly broad, using expansive keywords and generic usage phrasing that could cause the agent to invoke this skill for loosely related requests. Over-broad triggering is risky because the skill has unnecessary `exec` permission and ambiguous operation semantics, so accidental activation could expose user content or expand agent behavior unexpectedly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill fails to warn that submitted text, code, or documents may be sent to an underlying LLM/API, which is a privacy and confidentiality issue. In this context, the risk is elevated because translation inputs commonly contain proprietary source code, internal documents, credentials in config snippets, or personal information that users may not realize are leaving their immediate environment.

Static analysis

No suspicious patterns detected.