Security audit

翻译

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a translation helper, but it asks for broad tool access and includes unrelated automation and messaging behavior that users should review before installing.

Install only if you are comfortable with a translation skill that also advertises broader automation behavior and has read/write/exec authority. Avoid using it on confidential files unless you have confirmed where the text is processed and whether file contents may leave your environment.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is declared as a translation tool, but the documentation advertises unrelated messaging, callback, queuing, and archival features. This scope mismatch can mislead the agent into granting or invoking capabilities beyond the user’s expectation, increasing the chance of inappropriate tool use or hidden secondary behaviors.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: Documenting DAG/workflow execution for a translation skill materially expands the implied behavior from content transformation to orchestration. In a skill with exec/write tools, this ambiguity can cause the agent to treat the skill as an automation runner rather than a narrow translator, widening misuse potential.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill includes and normalizes command execution capability even though translation does not inherently require shell execution. Unnecessary exec access increases the attack surface, especially if future prompts or ambiguous instructions cause the agent to run commands on local files or environment state.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation criteria are so broad that the skill may trigger for generic productivity or automation requests unrelated to translation. In context, this is more dangerous because the skill has read/exec/write permissions, so accidental invocation could expose documents or enable unnecessary side effects.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The example guidance tells the agent to respond whenever a user mentions translation needs, without scope checks or safety gates. This can over-activate the skill and bypass confirmation about file handling, external API use, or whether the user actually wants translation versus analysis or editing.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill supports batch/file translation and depends on an LLM API, but it does not clearly warn that document contents may be transmitted off-system. This is a significant privacy and data-handling risk because users may submit proprietary, regulated, or sensitive text under the assumption that processing is local.

Static analysis

No suspicious patterns detected.