Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Tibetan-Chinese translation and OCR skill that uses a documented remote API with user-provided files and API keys, without hidden execution or persistence.
Install this only if you are comfortable sending Tibetan/Chinese text, images, DOCX files, or PDFs you choose to process to the AI Skills service and its model/OCR backend. Avoid using it for highly sensitive documents unless your organization accepts that processing path and retention posture, and keep the configured API key private.
This markdown file presents all user-facing instructions in Chinese and does not indicate that the skill is region-specific or provide an opt-in for language/locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
The document states that scanned or mixed PDFs will undergo OCR and then translation, but it does not clearly warn users that uploaded document contents may be transmitted to downstream OCR/translation services for processing. This creates a real privacy and compliance risk because users may upload sensitive documents without informed consent or awareness of third-party processing and retention behavior.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
API_ROOT="${AI_SKILLS_API_URL:-https://ai-skills.open-idea.net}/api/v1"
REQUEST_KEY="tibetan-$(date +%s)-translate"
curl --fail-with-body "$API_ROOT/tibetan-ai/translation" \
-H "Authorization: Bearer ${TIBETAN_AI_SKILL_API_KEY:-$AI_SKILLS_API_KEY}" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: $REQUEST_KEY" \
Line L07 states '中文与藏语严格互译', which enforces a specific language pairing as a strict rule. This is a natural-language locale constraint presented without any user choice, opt-in, or documented justification that the skill is region- or compliance-specific.
The document title and all operational instructions are written exclusively in Chinese, which effectively forces a specific language for users or maintainers consuming this skill guidance. The policy allows locale constraints only when users are given a choice or the restriction is explicitly justified, neither of which appears here.
文档将 from 和 to 参数硬性限定为 zh 或 bo，体现出该技能仅支持特定语言对，但未说明这是面向特定区域/业务场景的受限能力，也未提供用户层面的语言选择背景。根据规则，强制特定语言而无明确说明时可能构成自然语言策略问题。
No suspicious patterns detected.