Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Markdown Doc Multilingual Translator

v1.0.0

Translates Markdown files between six languages preserving structure, code, links, and formatting with glossary support and output validation.

0· 99·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The included scripts (parser, detector, translator, glossary manager, validator) align with the skill's description of translating Markdown while preserving structure and applying glossaries. Functionality described matches the code artifacts and reference docs.
Instruction Scope
Runtime instructions are focused on translating Markdown files, handling glossaries, and validating output. Commands reference only the provided scripts and supported features (single file, batch, glossary, validation). There are no instructions that request unrelated system data or to modify unrelated configs.
Install Mechanism
No install spec is provided (lowest install risk), but the package includes multiple Python scripts and documentation that expect Python packages (requests, pyyaml, markdown, and an LLM client). The README and SKILL.md assume these are preinstalled in the environment; that assumption should be verified in your runtime environment.
!
Credentials
SKILL.md and README reference a Claude/Anthropic API key and network access (e.g., --api-key or CLAUDE_API_KEY, and an 'anthropic' client in README) yet registry metadata lists no required environment variables or credentials. This mismatch is important because translation will send document text to an external API (privacy/data-exfiltration risk). Confirm exactly which env var names are read by the code and whether any other credentials are accessed.
Persistence & Privilege
The skill does not request always:true, does not declare required config paths, and does not claim to modify other skills or system-wide settings. It appears to run as a normal, user-invocable tool.
What to consider before installing
What to check before you install or run this skill: 1) Credentials & privacy: The SKILL.md/README expect a Claude/Anthropic API key (via --api-key or env var) and network access for translation. The registry metadata did not declare required env vars — inspect translator.py to confirm exact env var names (e.g., CLAUDE_API_KEY, ANTHROPIC_API_KEY) and endpoints. If you will translate sensitive or proprietary docs, prefer a local/offline translation mode or review terms of the external API provider. 2) Dependencies: The package expects Python dependencies (requests, pyyaml, markdown, and an LLM client). Ensure those libraries come from trusted sources in your environment and are pinned if you install them yourself. 3) Inspect network calls: Open scripts/translator.py and any code that does HTTP requests to confirm what is sent to external servers (full document text vs. segmented or redacted snippets), whether logs include original content, and what endpoints are used. 4) Test with non-sensitive data: Run translations on safe sample files first to confirm behavior (where requests go, what is logged, and if URLs or code blocks are preserved). Use --validate and --verbose to inspect reports. 5) Glossary & data files: Review included glossaries and any references for private data; custom glossaries are loaded from disk and may be merged — ensure they don't inadvertently include secrets. 6) Ask the publisher: Because the package source/homepage is unknown and the registry metadata omits expected env vars, prefer to use only if you can audit the code or get a trustworthy source. If you cannot audit, treat networked translation as a potential data-exfiltration risk and avoid processing sensitive documents.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fmrrmvqb8gd056y9y8j18pd83486x

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments