T09 · Insecure Skill Coding Practices
Error
- Location
scripts/translate_srt.py:84- Finding
Bearer credentials and subtitle content may be transmitted over plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Subtitle Translator
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to translate subtitles as described, but it needs review because it sends subtitle text and bearer API keys to user-chosen endpoints without enforcing HTTPS and requires keys on the command line.
Install only if you are comfortable sending subtitle contents to the configured API provider. Use trusted HTTPS endpoints only, avoid untrusted proxies, prefer short-lived or restricted API keys, and rotate any key that was pasted into shell history or logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/translate_srt.py:138- Finding
API keys are required as command-line arguments despite documented secure configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If parts of the referenced implementation only validate SRT files rather than translate them, the documented behavior materially overstates the skill's function. Description-behavior mismatches are dangerous in agent ecosystems because reviewers and users may grant trust, inputs, or permissions based on inaccurate claims.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If parts of the referenced implementation only validate SRT files rather than translate them, the documented behavior materially overstates the skill's function. Description-behavior mismatches are dangerous in agent ecosystems because reviewers and users may grant trust, inputs, or permissions based on inaccurate claims.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documentation describes capabilities involving environment variables, file reads/writes, and network access, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can cause overbroad execution privileges and make it harder to enforce least privilege for a skill that handles files and transmits data externally.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This workflow sends subtitle contents and an API key to an external OpenAI-compatible endpoint. Even if expected for translation, it creates a real data-exfiltration path for potentially sensitive subtitle text, and the risk is heightened because users may replace the URL with an untrusted endpoint.
- Content
--output video_zh.srt
--source-lang en
--target-lang zh
--api-url https://api.openai.com/v1
--api-key sk-...
--model gpt-4text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The bilingual translation example also transmits subtitle content and credentials to an external API. This is a genuine security concern because the skill's core function depends on remote processing, which can expose both content and secrets if the endpoint or transport path is untrusted.
- Content
--source-lang en
--target-lang zh
--bilingual
--api-url https://api.openai.com/v1
--api-key sk-...text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
Listing models from an external API still transmits an authentication token and metadata to a remote service. While lower impact than uploading subtitle contents, it can disclose credential use and service relationships and may be abused if the configured endpoint is malicious.
- Content
bash python3 scripts/list_models.py \ --api-url https://api.openai.com/v1 \ --api-key sk-...
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The documented environment-variable configuration supports external transmission of subtitle content and secrets to a remote API. This is expected behavior for the skill, but it remains a real exposure point because a compromised runtime, proxy, or untrusted endpoint can capture both data and credentials.
- Content
Option 1: Environment Variables (Recommended)
bash export SUBTITLE_API_URL="https://api.openai.com/v1" export SUBTITLE_API_KEY="sk-your-api-key" export SUBTITLE_MODEL="gpt-4"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
Passing the API key on the command line risks external transmission to the endpoint and local disclosure through shell history, process listings, audit logs, or job control systems. Combined with networked translation, this creates both secret-exposure and data-exfiltration risks.
- Content
python3 scripts/translate_srt.py
-i input.srt
-o output.srt
-u https://api.openai.com/v1
-k sk-your-api-key
-m gpt-4text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
Persisting configuration under the user's home directory introduces session persistence for sensitive settings, including the documented API key. Persistent local storage increases the attack surface because credentials may survive beyond the task, be backed up unintentionally, or be readable by other local processes or users.
- Content
Option 3: Config File (Less Secure)
Create
~/.openclaw/skills/subtitle-translator/config.json:json {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The config example stores the API URL and plaintext API key for use in authenticated external requests. This creates persistent credential exposure on disk in addition to the normal remote-transmission risk, especially if file permissions are weak or the host is multi-user.
- Content
json { "api_url": "https://api.openai.com/v1", "api_key": "sk-your-api-key", "model": "gpt-4", "batch_size": 50,
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a skill for translating SRT subtitle files while preserving timestamps, but this script implements separate API model discovery against an OpenAI-compatible endpoint. Enumerating available models and consulting process environment proxy settings are not necessary parts of subtitle-file translation as described, making this an unjustified extra capability relative to the stated purpose.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
User-controlled subtitle text is inserted directly into the LLM prompt, so crafted subtitle content can act as prompt injection and steer the model away from the intended translation task. In this skill's context, the main consequence is integrity loss of translation output and possible leakage of surrounding prompt content or instruction-following anomalies, especially because the tool trusts the model's structured output format.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script sends subtitle text to an external OpenAI-compatible API, but it provides no explicit disclosure, consent prompt, or safety guard around potentially sensitive subtitle contents. This creates a real confidentiality risk because users may process proprietary, personal, or unreleased media text without realizing it is being transmitted off-host to a third-party service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI sets the default target language to 'zh', which imposes a specific locale when the user does not explicitly choose one. This can violate language-choice policy because the skill defaults to a fixed language rather than requiring user selection or presenting an opt-in.
- Content
Static analysis
No suspicious patterns detected.