babel

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill explicitly extracts the previous assistant response verbatim and instructs the translation to be returned verbatim, which forces the LLM to include any secrets or credentials present in the source text in its output.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill deliberately reads the user's local Claude session transcript to extract the previous assistant response and then sends that verbatim text to external CLI backends (codex/agy/claude), creating a direct data-exfiltration path that can leak conversation content or embedded secrets/credentials.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). Outsider-authored free text can be ingested because SKILL.md step 1 writes verbatim assistant text from the current session transcript into "$WORK/source.md" via scripts/extract_last.py, and that transcript may include non-operating-user contributions; the LLM then reads it as < "$WORK/source.md" in the translation backend commands.