Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent video translation skill that sends user-provided videos or video URLs to a disclosed remote translation API, with some documentation quality issues but no hidden persistence, deception, or unrelated destructive behavior found.
Install only if you are comfortable sending video files or video URLs, plus your translation API key, to audiox-api-global.luoji.cn. Avoid using it for confidential, regulated, copyrighted, or sensitive personal videos unless you have reviewed the service's privacy and retention terms.
The skill instructions and operational guidance are entirely presented in Chinese, while the file targets broad agent platforms and non-China users are explicitly mentioned. There is no statement offering the user a choice of interaction language or clarifying that Chinese-only guidance is intentional and region-scoped.
The skill instructs users to upload local video files or provide video URLs to a third-party remote service, but it does not present a prominent pre-transmission warning or consent checkpoint at the point of action. Because videos may contain personal, confidential, or copyrighted content, silent or insufficiently disclosed off-system transfer can lead to unintended data exposure and compliance issues.
The manifest repeatedly describes a narrowly scoped free tool for single-video translation and status polling. However, lines L102 and L119 state that execution supports '创建/查询/导出操作', which expands the apparent operational scope to generic export actions not otherwise part of the declared free-edition capability set.
This skill explicitly performs external transmission of user-supplied video content and API credentials to a remote endpoint. In the context of a video-translation tool, such transmission is expected, but it remains security-relevant because uploaded media can contain sensitive data and the skill also permits remote URL ingestion that may expose user data to third-party infrastructure.
# 提交翻译任务
curl -s -X POST 'https://audiox-api-global.luoji.cn/video-trans/orchestrate' \
-H 'Authorization: Bearer ${API_KEY}' \
-F 'video=@/path/to/video.mp4' \
-F 'sourceLanguage=zh' \
The trigger text says to use the skill whenever text translation, multilingual conversion, or localization is needed, which is much broader than this skill’s documented purpose of single-video Chinese/English translation. This ambiguity could cause unintended invocation for generic text-translation requests or unsupported language scenarios.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
brew install jq
# ...
# Ubuntu / Debian 安装 jq
sudo apt install jq
# ...
# 验证安装
curl --version
Lines L67-L79 clearly state that bilingual subtitles are not supported in the free version. Yet L249 documents a 'bilingual' boolean input parameter, which contradicts the stated unsupported capability and may mislead an agent into attempting a disallowed mode.
Earlier sections explicitly state that all requests are sent to the remote base URL and that offline use is not supported. Line L446 then claims '本地运行', which actively conflicts with the documented network-dependent execution model.
No suspicious patterns detected.