TranslateFlow

PassAudited by ClawScan on May 10, 2026.

Overview

TranslateFlow is a straightforward translation API skill, but users should know it sends text to an external service and uses an API key or email-based signup.

This skill appears coherent and purpose-aligned. Before installing or using it, confirm you trust the TranslateFlow endpoint, use a dedicated API key, and avoid translating sensitive content unless the provider’s privacy and retention terms are acceptable.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any text translated through this skill may be transmitted to the TranslateFlow service.

Why it was flagged

The skill sends user-provided text to an external translation API. This is expected for the stated purpose, but users should understand that submitted content leaves their local environment.

Skill content

curl -X POST https://anton.vosscg.com/v1/translate ... -d '{"text": "Hello world", "target_lang": "es", "tone": "formal"}'

Recommendation

Do not submit secrets, private documents, or regulated data unless you trust the provider and its data handling terms.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill may use your email to obtain a service key and may use that key for translation API calls.

Why it was flagged

The helper uses a provider API key or an email address to create one. This is purpose-aligned, but the registry metadata does not declare required environment variables or a primary credential.

Skill content

API_KEY="${TRANSLATEFLOW_API_KEY:-}"
EMAIL="${TRANSLATEFLOW_EMAIL:-}"
if [ -z "$API_KEY" ] && [ -n "$EMAIL" ]; then ... /v1/keys ...

Recommendation

Use a dedicated API key for this service, avoid sharing sensitive credentials, and be aware that the generated key may appear in command output.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less independent context for verifying the service operator or API terms.

Why it was flagged

The artifacts are small and coherent, but provider/source provenance is limited because no homepage or source repository is supplied.

Skill content

Source: unknown
Homepage: none
No install spec — this is an instruction-only skill.

Recommendation

Verify the provider and endpoint before sending important or confidential translation content.