Google Cloud Translate Pro
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill appears to translate via an external API, but should be reviewed because it markets itself as Google Cloud Translate while actually using SocketsIO and an undeclared API key.
Install only if you are comfortable using SocketsIO as the translation provider, not just Google Cloud by name. Verify the API key, pricing, privacy policy, and endpoint before translating sensitive text.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user may believe they are using Google Cloud directly, while their text and API credential are actually sent to a third-party SocketsIO service.
The same artifact presents the skill as Google Cloud Translation with zero-config setup, but directs users to sign up with SocketsIO and use a SocketsIO API key. This creates a material trust and data-destination mismatch.
description: "Translate text across 195 languages using Google Cloud Translation API with zero-config setup..." ... curl -X POST https://api.socketsio.com/auth/signup
Treat this as a third-party SocketsIO translation wrapper unless the publisher clearly documents the relationship to Google, the data handling, and the actual provider endpoint.
You will need to create and expose a SocketsIO API key to the skill for it to work.
The skill needs a provider API key. That is purpose-aligned for an API translator, but the registry metadata declares no required env vars or primary credential, so the credential dependency is under-declared.
export SOCKETSIO_API_KEY=tr-your-key-here ... The script reads `SOCKETSIO_API_KEY` from environment.
Use a dedicated, low-privilege API key if possible and confirm the account, pricing, and credential-revocation options before use.
Text submitted for translation may include sensitive content and will leave the local environment for the configured API service.
The script sends the API key and translation requests to an external provider endpoint, and that endpoint can be overridden by an environment variable. This is expected for the translation function, but users should know the data boundary.
API_BASE = os.environ.get("SOCKETSIO_API_BASE", "https://api.socketsio.com") ... headers = {"X-API-Key": API_KEY, "Content-Type": "application/json"}Do not translate secrets or highly sensitive text unless you trust the configured endpoint and understand the provider's retention and privacy policies.