Straker Verify - AI Translation & Human Review

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward Straker translation API skill that requires an API key and may upload text or documents to Straker, with no hidden code or malicious behavior shown in the artifacts.

Before installing, make sure you are comfortable providing a Straker API key and sending selected text or documents to Straker for translation or review. Use a limited API key where possible and confirm uploads, project creation, and human verification requests before proceeding.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used carelessly, the agent could submit the wrong file or create a translation project the user did not intend.

Why it was flagged

The skill documents authenticated API calls that create translation projects and upload files. This is expected for a translation service, but project creation and file upload should remain user-directed.

Skill content

curl -X POST https://api-verify.straker.ai/project \
  -H "Authorization: Bearer $STRAKER_VERIFY_API_KEY" \
  -F "files=@document.txt" \
  -F "languages=<language-uuid>"

Recommendation

Confirm the exact files, target languages, and whether a project or human review should be created before sending content to the API.

Low

#ASI03: Identity and Privilege Abuse

What this means

Requests made through the skill may be associated with the user's Straker account and could consume account resources or access projects allowed by that key.

Why it was flagged

The skill requires a Straker API key and uses it as a bearer token for authenticated service access. This is appropriate for the integration but gives the agent delegated access to the user's Straker account.

Skill content

All requests (except `/languages`) require Bearer token authentication: ... Authorization: Bearer $STRAKER_VERIFY_API_KEY

Recommendation

Use a dedicated, revocable API key with the minimum permissions needed, and avoid sharing the key in chat or files.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Sensitive documents submitted for translation or human review may leave the local environment and be processed by Straker or its reviewers.

Why it was flagged

The skill can send user content to an external provider and, for human verification, potentially to human reviewers. This is disclosed and purpose-aligned, but it affects data handling expectations.

Skill content

Human Verification: Professional human review for critical content ... curl -X POST https://api-verify.straker.ai/human-verify ... -F "files=@translated.txt"

Recommendation

Review Straker's privacy and data-handling terms before sending confidential, regulated, or proprietary content.