OmniTranslate

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:01 AM UTC
• Version: 1.0.0

Overview

This translation skill is coherent, but its validation guidance can lead an agent to install dependencies and run a user's project commands without clear approval or sandboxing.

Install only if you are comfortable with the agent potentially running commands from the artifact being translated. For untrusted repositories or docs sites, require review of the exact commands first and run any install, build, test, lint, or render step in an isolated environment without sensitive credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/artifact-pipelines.md:23

Finding

Execution of Untrusted Target-Project Toolchains During Validation

Content

View full analysis

Vulnerability Details

File Location: references/artifact-pipelines.md:23,36,62; references/workflow.md:47; references/quality-gates.md:37
Vulnerability Type: Execution of untrusted project installation, build, test, lint, rendering, and native toolchain commands
Risk Level: High

Vulnerable Instructions

references/artifact-pipelines.md:23

text

5. Rebuild and run tests after reinsertion.

references/artifact-pipelines.md:34-39

text

### Validation

- Run the build, tests, and linting if available.
- Visually inspect pages at desktop and mobile breakpoints.
- Check buttons, menus, cards, tables, and form labels for overflow.
- Verify placeholders, links, and interpolation variables remain intact.

references/artifact-pipelines.md:60-64

text

### Validation

- Re-render the docs if a toolchain exists.
- Verify headings, anchors, tables, and code fences remain intact.
- Check that localized captions and alt text still match the media they describe.

references/workflow.md:45-48

text

## 7. Reinsert and rebuild

- Reinsert translations into the original structure whenever possible.
- Preserve ordering, relationships, metadata, notes, and text runs if the format supports them.
- Rebuild with the native toolchain when that is the most reliable path.

references/quality-gates.md:35-41

text

## Code and web gates

- Install, build, and run tests where practical.
- Verify no syntax errors were introduced while translating literals.
- Inspect key pages at desktop and mobile breakpoints.
- Check buttons, forms, nav items, modals, tables, and cards for overflow or clipping.
- Verify locale bundles, fallback chains, and interpolation variables still work.

Technical Analysis

The Skill directs an Agent to install dependencies and execute build, test, lint, documentation-rendering, or native toolchain commands belonging to a user-supplied localization target. Such targets must be treated as untrusted. ...[truncated 2831 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every localization target and its toolchain as untrusted.
2. Replace unconditional validation guidance with static or non-executing checks by default.
3. Require explicit user approval before installing dependencies or running any target-project command.
4. Before approval, disclose the exact command, working directory, expected side effects, and whether network access is required.
5. Inspect package manifests, lockfiles, lifecycle scripts, test setup files, build plugins, documentation plugins, and command definitions before execution.
6. Run approved commands only inside a disposable sandbox or container with:
   • No mounted credentials or host configuration.
   • A minimal read-only source mount where practical.
   • A dedicated writable output directory.
   • Restricted process and filesystem permissions.
   • Outbound network access disabled by default.
   • Resource and execution-time limits.
7. Disable lifecycle scripts where supported, such as using package-manager options that prevent install hooks.
8. Require pinned dependencies and integrity verification before installation.
9. Prefer existing trusted dependencies and offline caches over downloading mutable packages.
10. Separate translation output from validation output and verify that validation did not introduce unrelated file changes.
11. Document when dynamic validation was skipped because it could not be performed safely.
12. Add explicit wording such as:

text

Do not install dependencies or execute build, test, lint, rendering, or native
project commands from an untrusted target by default. Use static validation
unless the user explicitly approves the exact commands and they can be run in
an isolated environment without credentials or unrestricted network access.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file includes a bare language selector, "English | [简体中文]", without any context about how language selection is meant to work or whether it is merely navigational. In markdown files, vague trigger-like phrases or activation descriptions should be specific enough to avoid ambiguity, and this line provides no constraints or negative examples.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Line L83 references specific locales and language groups ('German, French, Spanish' and 'CJK') as default planning assumptions. Because this file is natural-language guidance and does not explicitly say locale selection must come from the user, it can be read as prescribing locale behavior without user opt-in.

Content

No source excerpt is available for this finding.