Eudic Openapi Skills Local

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a straightforward Eudic/OpenAPI instruction skill, but users should understand it uses an API token and can change or delete their vocabulary and note data.

This skill appears coherent and purpose-aligned. Before using it, make sure you trust the Eudic API token handling in your agent environment, confirm any delete or rename actions before they run, and only upload audio files you intend to send to Eudic for scoring.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent with the token may be able to read or modify the user's Eudic vocabulary and note data within the token's permissions.

Why it was flagged

The skill requires an account API token to access Eudic OpenAPI. This is expected for the service integration, but the token grants delegated account access.

Skill content

访问 https://my.eudic.net/OpenAPI/Authorization 获取 API Token ... 格式：`NIS {token}`

Recommendation

Use a token only from the official Eudic authorization page, avoid sharing it, do not paste it into public logs, and revoke or rotate it if exposed.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If invoked for deletion or modification, the agent could remove vocabulary books, words, or notes from the user's Eudic account.

Why it was flagged

The documented use cases include creating, changing, and deleting user account data. This is aligned with the skill's purpose, but it is higher-impact than read-only lookup.

Skill content

查看我的生词本 ... 添加单词到生词本 ... 删除生词本/单词/笔记

Recommendation

Ask the agent to show the exact item and action before destructive changes, and avoid broad deletion requests unless you are sure.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Audio submitted for scoring leaves the local device and is sent to Eudic's API.

Why it was flagged

The voice evaluation feature uploads a selected WAV file and prompt text to the Eudic API. This is disclosed and purpose-aligned, but it is a third-party data flow.

Skill content

curl -s -X POST "https://api.frdic.com/api/open/v1/voice/eval" ... -F "line=Hello world" ... -F "voice=@test.wav"

Recommendation

Only upload intended audio files, and avoid recordings that contain private conversations or sensitive information.