Addis Assistant

This skill appears to do what it claims (Amharic STT and translations) but there are a few things to check before installing or running it: - Verify the service/domain: api.addisassistant.com has no listed homepage in the package metadata. Confirm the API provider is legitimate and trustworthy before sending audio or text and before giving them an API key. - Provide the API key carefully: the scripts expect the x-api-key as a command-line argument, which can be visible in process lists on your system. Prefer passing secrets via a secure mechanism (stdin, environment variable, or a secrets manager) and avoid typing keys directly on shared machines. - Required binary not declared: the scripts call the curl binary but the skill metadata does not list curl as required. Ensure curl is installed, or review the scripts and consider using a vetted implementation (e.g., Python requests) that clearly documents dependencies. - Confirm TLS/URL: the examples use api.addisassistant.com without an explicit scheme; ensure the real requests use HTTPS (https://api.addisassistant.com) so data is encrypted in transit. - Audit the code before running: the included scripts are short and readable, but you should review them yourself to ensure they match the shipped content and that no modifications exfiltrate data elsewhere. Given the unknown origin and the metadata mismatches, do not hand over sensitive or high-privilege API keys until you verify the service and fix the dependency/credential handling. If you want, I can list concrete changes to make the skill safer (declare curl as required, accept API key via env or stdin, add HTTPS to endpoints, or replace curl with requests).