ClawHub
Back to skill

Security audit

Translator Pro Test

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local translation-testing helper with some quality bugs but no evidence of hidden data access, exfiltration, persistence, or destructive behavior.

This skill appears safe to install from a security perspective, but it is very limited and likely buggy: several commands may not use arguments as documented, and the dictionary examples are hard-coded. Expect a local data directory to be created under ~/.local/share/translator-pro-test/ when the script runs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Whitespace Padding

Medium
Category
Prompt Injection
Content
DATA_DIR="$HOME/.local/share/translator-pro-test"
mkdir -p "$DATA_DIR"

#
#
#
#
Confidence
80% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
In main(), each subcommand is invoked after 'shift', so inside handlers the first user argument is $1, not $2. However, the usage strings and implementation in cmd_test, cmd_dict, cmd_compare, cmd_glossary, cmd_quality, and cmd_batch all read from $2/$3/$4 and print examples based on those positions, which contradicts the actual call convention and causes the commands to ignore or mis-handle user input.

Natural-Language Policy Violations

Low
Confidence
79% confidence
Finding
The dictionary output hard-codes multilingual examples including Chinese text in a way that reflects a built-in locale/content choice, but the script provides no documented user opt-in or locale-selection behavior. Under the policy, fixed language behavior can be a natural-language locale issue when the user is not given a choice.

Static analysis

No suspicious patterns detected.