TranslateFlow

AI translation via TranslateFlow API — multi-language content translation, localization, tone adaptation, batch translation. Use when user needs text transla...

Before installing, confirm you trust the endpoint (https://anton.vosscg.com) and the publisher — the package has no homepage/source listed. Be aware the skill will either (a) ask you to provide an API key or (b) POST your email to the service to obtain a key; it will print the key to stderr which may leak into logs. Ask the publisher to update the registry metadata to declare required env vars (TRANSLATEFLOW_API_KEY or TRANSLATEFLOW_EMAIL) and to avoid printing secrets to stderr. If you decide to use it, prefer providing an explicit API key (not an email for auto-signup), run it in an isolated environment, and verify the API base URL (TRANSLATEFLOW_API_URL) before setting it.

Type: OpenClaw Skill Name: translateflow Version: 1.0.0 The skill bundle is suspicious due to critical vulnerabilities. The `scripts/forge-client.sh` script is susceptible to shell injection in its `translate` and `batch` actions, as it directly passes user input (`$1`) to `curl -d` without sanitization, potentially leading to arbitrary command execution. Additionally, the `API_BASE` can be overridden via the `TRANSLATEFLOW_API_URL` environment variable, allowing redirection of API calls to arbitrary endpoints (e.g., `anton.vosscg.com`), which could be exploited for data exfiltration or malicious responses.