Back to skill
Skillv1.0.0
ClawScan security
UAPI AI翻译配置 接口 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 4:50 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This instruction-only skill cleanly wraps a single UAPI endpoint (GET /ai/translate/languages); its requests and instructions match the declared purpose and it does not request extra privileges or install code.
- Guidance
- This skill is coherent and low-risk: it only documents and wraps a single public API endpoint. Before installing, note that the agent will make network calls to https://uapis.cn when invoked (so avoid sending sensitive secrets or private data to the translation endpoint). If you plan to use it repeatedly, create and use a UAPI Key per the provider's instructions to avoid anonymous rate limits. As always, verify the UAPI domain and review the provider's privacy/terms if you will send confidential text for translation.
Review Dimensions
- Purpose & Capability
- okThe name/description claim a single UAPI endpoint (AI 翻译配置). The skill requires no binaries, env vars, or special config and only documents calling GET /ai/translate/languages, which is coherent with the stated purpose.
- Instruction Scope
- okSKILL.md instructs the agent to read included reference docs and call the specified endpoint; it does not direct reading unrelated files, accessing local credentials, or exfiltrating data to unexpected endpoints. It only references the UAPI base URL and suggests obtaining a UAPI Key if rate limits are hit.
- Install Mechanism
- okNo install spec and no code files to execute. Instruction-only skills have minimal disk/system impact.
- Credentials
- okThe skill declares no required environment variables or credentials. The mention of a UAPI Key is advisory and appropriate for an API wrapper; no unrelated secrets are requested.
- Persistence & Privilege
- okalways is false and the skill does not request elevated or persistent system privileges. It can be invoked autonomously (platform default), which is expected for a callable skill.