Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Uyghur/Chinese language service that sends user-provided text or files to its API only for the requested translation, OCR, or writing task.
Install this only if you are comfortable sending requested Uyghur/Chinese text, documents, or images to the ai-skills.open-idea.net service or to any custom AI_SKILLS_API_URL you configure. Prefer the product-specific UYGHUR_AI_SKILL_API_KEY if you want tighter key isolation, and avoid submitting sensitive documents unless the service's data handling terms meet your needs.
The manifest description is written to activate when the user requests Uyghur translation or related tasks, but it frames the capability specifically around Chinese↔Uyghur handling rather than offering a broader language or locale choice. Under the policy rule, language constraints should be optional or clearly justified; no opt-in or justification is provided here.
The entire file is written as prescriptive behavior rules in Chinese, and there is no indication that users may choose another language or that the skill is limited to a Chinese-specific deployment context. Under the stated policy, forcing a specific language without opt-in is a natural-language locale violation.
The text states that the endpoint is used for Uyghur Q&A, explanation, polishing, summarization, and creative writing. This is a natural-language locale restriction, but the file does not offer an opt-in choice of language or explain why the locale limitation is required, which can violate language/locale policy requirements.
The entire skill description is written only in Chinese and does not indicate that users may select another language or that the locale restriction is intentional for a region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
This markdown file contains user-facing instructions and examples exclusively in Chinese. Under the policy rule for language/locale, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
The document instructs sending user content and uploaded files to an external service endpoint using bearer-token authenticated curl requests. In this skill context, external transmission is expected, but it still creates a real data-exposure boundary: sensitive text, PDFs, and images may leave the local environment and be processed by a third-party service, which is dangerous if users have not explicitly consented or if the data is logged, retained, or sent to an untrusted deployment.
API_ROOT="${AI_SKILLS_API_URL:-https://ai-skills.open-idea.net}/api/v1"
curl --fail-with-body "$API_ROOT/uyghur-ai/translation" \
-H "Authorization: Bearer ${UYGHUR_AI_SKILL_API_KEY:-$AI_SKILLS_API_KEY}" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: uyghur-translate-001" \
The file’s natural-language instructions and operational guidance are entirely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. The policy requires flagging language or locale constraints when they are imposed without explicit opt-in or justification.
The instructions mandate strict preservation of Arabic text direction and constrain output formatting for all translations, while the document is entirely scoped to Chinese/Uyghur translation only. This creates a locale/language constraint without any indication that users can opt into alternatives or that the restriction is justified as a documented policy exception.
No suspicious patterns detected.