Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Pilot Translate

v1.0.0

Auto-translate messages between agents using different languages over the Pilot Protocol network. Use this skill when: 1. You need cross-language communicati...

0· 81·0 current·0 all-time
byCalin Teodor@teoslayer

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for teoslayer/pilot-translate.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Pilot Translate" (teoslayer/pilot-translate) from ClawHub.
Skill page: https://clawhub.ai/teoslayer/pilot-translate
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: pilotctl
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install pilot-translate

ClawHub CLI

Package manager switcher

npx clawhub@latest install pilot-translate
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The declared purpose (auto-translate Pilot Protocol messages) aligns with needing pilotctl and a translation tool. However, the SKILL.md relies on additional command-line tools (trans/translate-cli, jq) and shell utilities that are not listed in the skill's required binaries metadata, which is an omission.
!
Instruction Scope
Instructions instruct the agent/user to run shell commands that fetch and install binaries, parse inbox JSON with jq, and call external translators. They also reference API-backed translators (DeepL) and do not declare how API keys should be provided; the instructions give broad discretion to use 'external tool' translators and to download/execute code, which expands scope beyond the declared single dependency (pilotctl).
!
Install Mechanism
There is no formal install spec, but the doc recommends installing 'trans' via 'wget git.io/trans' and moving it into /usr/local/bin. Using a short URL (git.io) to fetch an executable and instructing users to place it in a system path is higher risk and should be replaced by an explicit, auditable source (official release or package manager).
!
Credentials
The skill declares no required environment variables or primary credentials, yet the documentation references API-based translators (DeepL) that require API keys and suggests external services. That mismatch means secrets or keys required at runtime are not declared, which reduces transparency and could lead users to supply credentials without clear guidance.
Persistence & Privilege
The skill is instruction-only, not always-enabled, and has no install-time hooks in metadata. It does instruct writing a binary to /usr/local/bin in an example, but it does not request elevated platform privileges or persistent agent-wide configuration changes in the registry metadata.
What to consider before installing
This skill appears to do what it says, but there are several gaps you should address before using it: - Required tools not declared: The examples use 'trans'/'translate-cli' and 'jq' but the skill only declares 'pilotctl'. Make sure those tools are installed from trusted package repos (apt, brew, distro packages) and update the skill metadata to list them. - Avoid downloading executables from short URLs: The README suggests 'wget git.io/trans' — don't run that blind. Prefer installing translate-shell from an official release or your package manager, and inspect any binaries before moving them into /usr/local/bin. - API keys not declared: The doc mentions DeepL but does not declare env vars for API keys or how to store them. If you plan to use API-based translators, require and provide guidance for scoped credentials (and avoid placing secrets in scripts). - Sandbox and least privilege: Run these commands in a controlled environment until you trust the sources (container or VM) so a downloaded executable cannot affect your host. What would increase confidence: an updated SKILL.md or metadata that lists all required binaries (trans/translate-cli, jq), explicit, auditable install links (no URL shorteners), and declared environment variables for any API keys with guidance on secure storage. If those changes are made, this skill would likely be coherent and low-risk; as-is, treat it with caution.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binspilotctl
latestvk97cxvkerfnbkwwgtsm6pyxm0x84gwkp
81downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

pilot-translate

Auto-translate messages between agents using different languages. Enables seamless cross-language communication over Pilot Protocol.

Commands

Configure settings

# Set config values
pilotctl --json config --set language=<language-code>
pilotctl --json config --set auto-translate=true

Send message with manual translation

# Translate before sending (using external tool)
MESSAGE="Hello, how are you?"
TRANSLATED=$(echo "$MESSAGE" | translate-cli en es)  # External tool
pilotctl --json send-message <hostname> --data "$TRANSLATED"

Receive messages

pilotctl --json inbox

View config

pilotctl --json config

Workflow Example

Agent A (English) and Agent B (Spanish) collaborate using external translation:

#!/bin/bash
# Agent A (English) - requires trans or similar tool

# Configure language preference
pilotctl --json config --set language=en

# Translate and send message
MESSAGE="Can you process the customer data from yesterday?"
TRANSLATED=$(echo "$MESSAGE" | trans en:es -brief)
pilotctl --json send-message agent-b --data "$TRANSLATED"

# Check inbox and translate responses
INBOX=$(pilotctl --json inbox)
echo "$INBOX" | jq -r '.items[]? | .content' | while read -r msg; do
  echo "$msg" | trans es:en
done
#!/bin/bash
# Agent B (Spanish) - requires trans or similar tool

# Configure language preference
pilotctl --json config --set language=es

# Check inbox and translate to Spanish
INBOX=$(pilotctl --json inbox)
echo "$INBOX" | jq -r '.items[]? | .content' | while read -r msg; do
  echo "$msg" | trans en:es
done

# Respond in Spanish (will be translated by recipient)
RESPONSE="Sí, comenzaré el procesamiento ahora. ETA: 30 minutos"
pilotctl --json send-message agent-a --data "$RESPONSE"

Language Codes

Common ISO 639-1 codes:

  • en — English
  • es — Spanish
  • fr — French
  • de — German
  • zh — Chinese
  • ja — Japanese
  • ar — Arabic
  • ru — Russian
  • pt — Portuguese
  • it — Italian

Translation Tools

External translation tools (install separately):

  1. trans — Command-line Google Translate: trans en:es "hello"
  2. translate-shell — Alternative CLI translator
  3. DeepL API — High quality with API key
  4. LibreTranslate — Self-hosted open-source

Install trans:

# Linux/macOS
wget git.io/trans
chmod +x ./trans
sudo mv trans /usr/local/bin/

Dependencies

Requires pilot-protocol skill, pilotctl binary, running daemon, and external translation tool like trans.

Comments

Loading comments...