Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real translation skill, but it stores API keys and custom backend choices across sessions and can reuse them without confirming where future text will be sent.
Review before installing. Use this only with endpoints you trust, avoid translating confidential documents unless the selected backend is approved for that data, and use limited-scope API keys. Be aware that the skill asks the agent to remember API keys, backend URLs, model names, and the active backend across sessions; clear or rotate those credentials if you stop using it or change backends.
| Backend ID | Display Name | Endpoint URL | Model Name | API Key | |-----------------|----------------|----------------------------------------------------------------------------------|-------------------------|----------------------| | `tencent_cloud` | Tencent Cloud | default: `https://api.hunyuan.cloud.tencent.com/v1/chat/completions`; user may provide a different URL | provided by user | provided by user | | `private_model` | Private Model | provided by user | provided by user | provided by user | **Backend descriptions**:
**Backend descriptions**: - **`tencent_cloud`**: Uses the Hy Translation API provided by Tencent Cloud. The endpoint URL has a built-in default (`https://api.hunyuan.cloud.tencent.com/v1/chat/completions`) — the user does not need to provide it. However, the user may optionally supply a different URL, which will be stored in memory and used going forward. A model name and API key are always required. Suitable for users who have access to Tencent Cloud services. - **`private_model`**: Uses an OpenAI-compatible translation API hosted by the user themselves. The endpoint URL, model name, and API key must all be provided by the user. Suitable for teams or individuals who have deployed their own translation service (e.g. an internal service). ---
4. **Credential resolution** — check memory for the active backend's credentials: **For `tencent_cloud`** — need: model name + API key; URL is optional - For the URL: check memory for `tencent_cloud_url`; if present use it, otherwise use the default `https://api.hunyuan.cloud.tencent.com/v1/chat/completions`. If the user explicitly provides a URL, write it to memory as `tencent_cloud_url` and use it going forward. - If `tencent_cloud_model` or `tencent_cloud_api_key` is missing from memory, ask the user to provide them. - Once provided, write to memory (`tencent_cloud_model`, `tencent_cloud_api_key`).
| Parameter | `tencent_cloud` value | `private_model` value | |---------------|------------------------------------------------------------------------------|--------------------------------------------| | `--backend` | `tencent_cloud` | `private_model` | | `--url` | `<tencent_cloud_url from memory>`, or omit to use default `https://api.hunyuan.cloud.tencent.com/v1/chat/completions` | `<private_model_url from memory>` | | `--model` | `<tencent_cloud_model from memory>` | `<private_model_name from memory>` | | `--api-key` | `<tencent_cloud_api_key from memory>` | `<private_model_api_key from memory>` |
1. **Check conversation history and memory** for the most recently used backend: - Look at recent messages in the current conversation first. - If not found in conversation, check memory key `active_translation_backend`. - If found, use that backend — **do not ask the user again**. 2. **If no prior backend is found** in history or memory: - Ask the user which backend to use: Tencent Cloud or Private Model.
59/59 vendors flagged this skill as clean.
No suspicious patterns detected.
