tech-translator

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs translating values in .env/.properties files (line 39), which can contain API keys or passwords and would require the model to read and reproduce secret values verbatim, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The SKILL.md required workflow ingests user-supplied plain text or a user-supplied URL (“Plain text → translates directly” and “URL → fetches then translates”), meaning outsider-authored free text can be directly provided at runtime to the LLM for translation.