Mongolian AI for Codex

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 2.0.1

Overview

This is a disclosed wrapper for a remote Mongolian AI service, and I found no hidden persistence, unrelated access, or destructive behavior.

Install only if you are comfortable sending requested text, images, audio, and documents to mongol.open-idea.net for processing. Do not use it on confidential, regulated, or personal files unless you explicitly approve that upload and understand possible billing. Keep the API key in local environment or secret-manager settings, not in chat.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a multi-function Mongolian AI skill covering translation, OCR, ASR, TTS, and document/media processing. This code chunk, however, is narrowly focused on chat completion over text messages using POST to /chat/completions/. It supports only two response modes (Traditional Mongolian or Chinese), accepts either a text prompt or a JSON message history file, and enforces output-script checks. There is no handling of images, audio, PDFs, Word files, OCR, ASR, TTS, or document translation in the supplied code. The code even states that if the user explicitly requests translation, a different endpoint should be used, indicating this script is not the translation implementation described. Therefore the declared description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

- `scripts/ocr.sh <image> [mw|mn]`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

- `scripts/asr.sh <audio> [mw|mn] [--sync] [--timeout SECONDS]`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

- `scripts/document-translate.sh <file> <from> <to> [mode]`

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares capabilities that include environment access, file reading, and shell execution but does not define an explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege controls and can let the runtime grant broader execution power than reviewers or users expect, which is especially relevant because the skill handles external network requests and local files/documents.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

## Rules

- Check whether the variable is non-empty without printing it.
- Never ask the user to paste a key into chat.
- Never save, copy, transform, or echo a key.
- Never read arbitrary shell history or configuration files to find a key.
- Let the user configure the key in their terminal, secret manager, or agent settings.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/API-KEY.md (reported line 8)May include surrounding context.

md

## Rules

- Check whether the variable is non-empty without printing it.
- Never ask the user to paste a key into chat.
- Never save, copy, transform, or echo a key.
- Never read arbitrary shell history or configuration files to find a key.
- Let the user configure the key in their terminal, secret manager, or agent settings.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L17 states 'Language: mw by default; mn for Cyrillic', which imposes a language selection policy in natural language without indicating user choice or opt-in. This can violate language/locale policy expectations when the user has not explicitly requested that default behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file hard-codes a system prompt requiring output only in Traditional Mongolian, regardless of the user's actual preference unless a separate Chinese-only branch is selected. This can override user intent, reduce transparency, and cause the agent to send or present content in an unexpected language/script, which is a genuine instruction-quality and safety issue for a multilingual skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This documentation instructs the agent to upload local Word/PDF documents to a remote translation service and even says to return only the translated text, but it does not include an in-file warning that the full document contents leave the host. Because these documents can contain sensitive business, legal, or personal data, users or downstream agents may transmit confidential content without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This documentation defines endpoints that transmit user text, images, audio, and documents to an external service, but the file itself does not require an explicit runtime warning or consent step before sensitive data leaves the system. In a skill that can handle OCR, ASR, chat, and document translation, this creates a real privacy and data-governance risk because users may unknowingly send confidential content to a third-party API.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction 'When charged amount and balance are available, emit:' is followed by a hard-coded Chinese message template, which forces a specific language in the skill's output. This is a natural-language policy violation unless the skill offers opt-in language selection or clearly documents a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L24 states that when the user does not specify the target for Chinese source text, the system should default to Traditional Mongolian. This forces a locale/language outcome without asking the user, which matches the policy category for language-choice violations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L25 instructs the skill to default to Chinese when a user asks what Mongolian text means unless another target is explicit. This is a natural-language policy issue because it forces a specific output language without obtaining user preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction says to default to mw for Traditional Mongolian and use mn only for Cyrillic, which imposes a locale/language choice rather than offering the user an explicit option. This is a natural-language policy concern because it can force a specific language behavior without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation instructs the agent to route unsupported source languages through Chinese as an intermediate language without requiring explicit user consent or presenting alternatives. This can expose user content to an additional transformation step and service context, increasing privacy, accuracy, and data-handling risk, especially for sensitive text or regulated content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This shell library emits a fixed Chinese billing summary string to stderr, which imposes a specific language on all users of the skill. The policy for natural-language violations applies to all file types, and there is no opt-in, fallback, or justification here for restricting output to Chinese.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_lib.sh (reported line 254)May include surrounding context.

sh

: > "$header_file"
    : > "$body_file"

    if HTTP_STATUS=$(curl -sS -o "$body_file" -D "$header_file" \
      -w '%{http_code}' -X "$method" "$@"); then
      curl_exit=0
    else

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sets LANGUAGE="mw" as the default and also advertises [language=mw] in the usage string, which imposes a specific locale unless the user explicitly overrides it. Under the policy, locale or language constraints should offer user choice or clearly justify the default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The system prompts mandate a specific language/script for each mode and do not offer user choice or opt-in within the interaction. This is a natural-language policy issue because the skill forces locale/language behavior rather than allowing the user to select or confirm it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This script serializes either direct user text or an entire conversation history file into a request body and sends it to a remote API endpoint. Although the skill metadata mentions remote transmission and warns against sending sensitive data, this script itself provides no runtime disclosure, confirmation, or content filtering before exfiltrating potentially sensitive prompts, history, or attached derived text.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The script is explicitly designed to call an external service using curl, and the later request uploads OCR input derived from a local file. In this skill context, external transmission is expected, but it is still a genuine security/privacy concern because local document contents leave the host and are processed by a third party.

Content

Scanner excerpt · scripts/ocr.sh (reported line 26)May include surrounding context.

sh

*) die "unsupported image extension: $EXTENSION" ;;
esac

require_commands curl python3
load_key

HEADER_FILE=$(mktemp)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This script base64-encodes the supplied image and sends it, along with the selected OCR language, to a remote API endpoint. In a skill that may process screenshots, scans, or documents, that creates a real data-exfiltration/privacy risk if users invoke it on sensitive content and the script itself provides no runtime confirmation or warning.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The script is designed to transmit input text to an external network endpoint using curl after loading an API key. External transmission is expected for a translation skill, but it is still a genuine security/privacy concern because arbitrary stdin/argument content may be exfiltrated to a remote service if upstream components do not obtain clear consent or filter sensitive data.

Content

Scanner excerpt · scripts/translate.sh (reported line 27)May include surrounding context.

sh

[ "$TEXT_LENGTH" -le 4000 ] ||
  die "translation text exceeds 4,000 Unicode code points; split it on natural boundaries"

require_commands curl python3
load_key

HEADER_FILE=$(mktemp)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This script sends user-supplied translation text to a third-party API but provides no runtime confirmation or warning at the point of transmission. In an agent setting, that can expose sensitive or confidential user content to an external service without sufficiently explicit user awareness, creating a real data-leakage/privacy risk even though the metadata mentions the service elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.