ClawHub

Universal Translate

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward translation skill with mild usability cautions around broad activation, English defaults, and optional file-copy output.

Safe for normal translation use. Be explicit about the target language, only ask it to translate files you intend the agent to read and copy, and say when interpreter mode should stop.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger phrases are broad enough to match normal multilingual conversation, which can cause the translation skill to activate when the user did not intend to invoke it. Unintended activation can alter routing, expose user text to unnecessary processing, and interfere with other skills or system behavior.

Natural-Language Policy Violations

Medium
Confidence
78% confidence
Finding
Defaulting to English translation without explicit user consent can cause the agent to transform content in a way the user did not request. In multilingual or privacy-sensitive contexts, this may lead to incorrect assumptions about user intent, accidental disclosure through translation workflows, or destructive changes to the original interaction context.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill instructs the agent to read and write files (for example, saving translated copies) without a prominent warning or explicit confirmation requirement in the user-facing description. This can lead to unintended file creation or modification, especially if the skill is auto-invoked or the user does not realize that a translation request will perform filesystem operations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal