Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward iFlytek translation skill that sends user-provided text to a disclosed translation API and does not show hidden persistence, privilege escalation, or destructive behavior.
Install only if you are comfortable sending translated text, stdin content, or explicitly selected files to iFlytek's external translation service using your XFYUN credentials. Do not translate secrets, regulated personal data, or confidential documents unless your organization has approved that provider and data handling.
The README describes translating text and files via the iFlytek API but does not clearly warn users that provided text or file contents are transmitted to an external third-party service. This omission can cause users to unknowingly send sensitive, proprietary, or regulated data off-system, creating privacy, confidentiality, and compliance risks.
The skill advertises capabilities that include environment-variable access, file reading, and outbound network access, but it does not declare an explicit tool/permission scope. That creates a governance gap: an agent platform or reviewer cannot easily constrain what the skill is allowed to do, even though it will handle secrets and send user/file content to an external API.
The trigger phrases are very broad and match common requests like 'translate this' or 'help me translate,' which can cause the skill to activate in many ordinary conversations. In context, that matters because activation may route sensitive user text to a third-party translation service without a deliberate, informed choice by the user.
The documentation explains how to use the translator but does not clearly warn that submitted text is transmitted to iFlytek's external service. For a translation skill, this omission is significant because users may paste secrets, personal data, or proprietary documents, not realizing that their content leaves the local environment.
The script transmits the user-provided text to iFlytek's remote translation service, but the CLI does not provide an explicit user-facing warning at the point of use that input content leaves the local environment. This is dangerous because users may unknowingly submit sensitive data such as secrets, proprietary text, or personal information to a third-party service, creating confidentiality and compliance risk.
A substantial portion of the natural-language documentation, including the FAQ and troubleshooting sections, is presented only in Chinese. This imposes a language choice on users without offering an alternative or stating that the skill is intended only for Chinese-speaking users.
The verbose output labels are fixed as Chinese strings ("原文" and "译文") with no option to select another language or locale. This creates a natural-language policy issue because the skill forces a specific language in its interface rather than offering user choice.
No suspicious patterns detected.
