Back to plugin

Security audit

ZhFix

Security checks across malware telemetry and agentic risk

Overview

The skill's code, instructions, and declared requirements are consistent with a translator/lookup plugin for Chinese LLM error messages; nothing requires unrelated credentials or network access, though a few implementation notes are worth checking before install.

This plugin appears to be what it says: a local, regex-based translator/lookup for Chinese LLM error messages. Before installing: 1) Be aware the plugin will automatically append translations to any tool output containing Chinese — if your agent handles sensitive output, that behavior may expose or alter content in ways you should accept consciously. 2) The repository includes a very large package-lock.json containing many third-party packages not listed in package.json; verify whether you will run any build/install steps that fetch or install those dependencies, and consider asking the author to publish a minimal lockfile or confirm the extra packages are benign. 3) No environment variables or credentials are required by the plugin itself, but follow usual caution: review any third-party code before running in production or on sensitive systems, and consider trying it first in a sandboxed agent.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.