ClawHub
Back to skill

Security audit

Auto Translate

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only translation skill that may make replies longer by adding English and Japanese translations, but it does not run code or access private data.

Install this only if you want the assistant to append English and Japanese translations when the skill is active. Expect longer replies and repeated sensitive text in multiple languages; avoid enabling it globally if you often need concise or single-language responses.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The manifest description says the skill applies to 'any Chinese-English-Japanese multilingual output scenario,' which is broad enough to activate on ordinary multilingual requests that may not actually need this skill. Overbroad routing can cause unintended skill invocation, leading to unnecessary output transformation and policy conflicts with user intent or higher-priority instructions.

Natural-Language Policy Violations

High
Confidence
96% confidence
Finding
The skill mandates a Chinese-first response followed by English and Japanese for every matching response, regardless of the user's requested language or format. This can override user intent and system behavior, causing persistent instruction hijacking within its scope and producing outputs that are misaligned, overly verbose, or noncompliant with language preferences.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.