Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent iFlytek translation skill that sends user-selected text to an external translation API, with privacy considerations users should understand before translating sensitive content.
Install only if you are comfortable sending text you ask to translate to iFlytek's translation service using your own API credentials. Do not translate secrets, private documents, regulated data, or proprietary content unless that use is acceptable under your organization's policy and iFlytek's terms. Consider removing the bundled .claude/settings.local.json packaging allow rule before redistribution.
The skill performs network access, reads files/stdin, and consumes environment secrets, but the manifest does not declare tool scope or permissions. This weakens review and runtime governance because users and platforms cannot clearly see that the skill may exfiltrate supplied text and use local secrets to call an external service.
The skill advertises translation functionality but does not prominently warn that user-provided text is sent to iFlytek's external API. Users may paste sensitive documents, credentials, or regulated data into the translator without realizing the content leaves the local environment, creating privacy and compliance risk.
The script sends arbitrary user-supplied text to a third-party translation service, but it does not provide any runtime warning, consent prompt, or clear disclosure at the point of transmission. This creates a privacy and data-handling risk because users may unknowingly submit secrets, personal data, or proprietary content to an external provider.
The script presents descriptive and verbose output strings in Chinese, such as the tool description and labels like '原文' and '译文', without any option to select another interface language. This creates a locale preference in natural-language behavior without documented user opt-in or justification.
No suspicious patterns detected.
