Excel Translator

ReviewAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it says, but users should know it sends spreadsheet text to an OpenAI-compatible translation API and uses local/API credentials.

Before installing, make sure you are comfortable sending the Excel file's text to the configured OpenAI-compatible endpoint and using the local API credentials. Avoid running it on confidential spreadsheets unless that provider and account are approved.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Text from the Excel workbook, potentially including sensitive or hidden-sheet content, may leave the local environment and be processed by the configured API provider.

Why it was flagged

The script sends collected spreadsheet cell text in a prompt to an OpenAI-compatible API for translation.

Skill content

response = client.chat.completions.create(... messages=[{"role": "user", "content": prompt}], ...)

Recommendation

Use this skill only for spreadsheets whose text may be shared with the configured translation provider, and confirm the OPENAI_BASE_URL points to an approved endpoint.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill may use an existing local API key/profile to make translation requests, which can incur provider usage and send workbook text to the configured endpoint.

Why it was flagged

The script uses local OpenAI API credentials and a configurable API base URL, while the registry metadata declares no primary credential or required environment variables.

Skill content

_secrets = _load_secret(); _api_key = _secrets.get("OPENAI_API_KEY") or os.environ.get("OPENAI_API_KEY", ""); _base_url = _secrets.get("OPENAI_BASE_URL") or os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1")

Recommendation

Confirm which OpenAI-compatible credential and base URL will be used before running the skill, especially in shared or production environments.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill relies on whatever compatible packages are already present in the environment; this may affect reliability or dependency trust, but no risky install behavior is shown.

Why it was flagged

The script depends on external Python packages, but the supplied artifacts include no install specification or pinned dependency versions.

Skill content

import openpyxl
from openai import OpenAI

Recommendation

Run it in an environment with known, trusted versions of openpyxl and openai if dependency provenance matters.