Xtranslate

Intelligently translate PDF, Word, Excel, PPT, TXT, and RTF files with format preservation, layout optimization, and multi-engine support including batch pro...

Summary and recommended next steps before installing or running Xtranslate: 1) Environment variables and API keys: SKILL.md and the code expect multiple cloud API keys (DeepSeek, OpenAI, Anthropic, SiliconFlow, and a custom key), but the registry metadata did not declare them — assume these keys will be used if you select a cloud engine. Only provide keys you trust and you are willing to allow the code to call external model APIs. 2) Stored 'encryption' is not secure: API keys saved via the GUI use a built-in CryptoUtils with a hard-coded password and salt. Anyone with access to the code can decrypt those stored keys. Do not rely on this for secure secret storage; prefer environment variables or a secure credential store under your control. 3) Network/endpoint review: The skill is designed to contact third-party model endpoints. If you plan to use cloud engines, review translator.py (not fully shown in the SKILL.md) to confirm which URLs are used and whether requests include full document content. If privacy is important, use the 'ollama' (local) or 'python' offline engine and test behavior in an isolated environment first. 4) File I/O and persistence: The tool will read input files, may recurse directories for batch jobs, and will write translation_monitor.json, summary files, and output documents. Run it in a safe directory and inspect files it writes. Clean up logs/monitor files if they contain sensitive paths or metadata. 5) Code quality and runtime behavior: Some GUI code appears truncated in the provided bundle (syntax/logic issues visible in truncated snippets), so you should run the code in a controlled environment and/or manually inspect translator.py and gui.py before use to ensure there are no crashes or unintended behaviors. 6) Recommended precautions: (a) test with the local/offline engine first, (b) run in a sandbox/VM if you will supply production API keys or sensitive documents, (c) inspect network connections (e.g., via a proxy) to confirm which data is sent externally, and (d) consider replacing the hard-coded crypto mechanism with a secure credential store if you will use this long-term. If you want, I can: (1) list the exact places in the code that read environment variables and where they are used, (2) search translator.py/network calls for remote endpoints and payload shapes, or (3) point out specific lines implementing the key storage/decryption so you can evaluate risk further.

Type: OpenClaw Skill Name: xtranslate Version: 3.2.0 The skill bundle provides a document translation tool with broad file system and network access. While the functionality aligns with its stated purpose, it contains a significant security vulnerability in `src/crypto_utils.py`, which uses a hardcoded password ('Xtranslate_Secret_Key') and salt for Fernet encryption of sensitive API keys. Additionally, the 'Smart Monitoring System' implemented in `translation_monitor.py` logs detailed metadata, including full local file paths, to a persistent JSON file (`translation_monitor.json`), which could lead to local information disclosure of sensitive file names and processing history.