← 返回 Skills 市场

Excel Translator

Name: Excel Translator
Author: ilove323

作者 ilove323 · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

534

总下载

当前安装

版本数

在 OpenClaw 中安装

/install excel-translator

功能描述

Translates Excel files (.xlsx) from English to Chinese while preserving all formatting, images, and charts. Use for any task where a user provides an Excel f...

使用说明 (SKILL.md)

Excel Translator Skill

Overview

This skill translates the text content of an Excel file (.xlsx) from English to Chinese using openpyxl. The Chinese translation is placed directly below the original English text in the same cell, separated by a newline — no new rows or columns are inserted. Original formatting (merged cells, fonts, colors, images) is preserved.

Workflow

Identify the input .xlsx file path from the user.
Run scripts/translate.py from the shell.
Deliver the output file to the user as an attachment.

Running the Script

python3.11 /home/ubuntu/skills/excel-translator/scripts/translate.py "/path/to/input.xlsx"

The output file is saved automatically with a _translated suffix in the same directory.

Custom output path:

python3.11 /home/ubuntu/skills/excel-translator/scripts/translate.py "/path/to/input.xlsx" -o "/path/to/output.xlsx"

Environment Variables

The script reads API credentials from environment variables. These are pre-configured in the Manus sandbox:

OPENAI_API_KEY — API key for the translation model.
OPENAI_BASE_URL — Base URL for the API endpoint (defaults to https://api.openai.com/v1).

Bundled Resources

scripts/translate.py — Core translation script. Scans all sheets, translates English text cells concurrently via OpenAI API, writes "English\ Chinese" back into the same cell with wrap_text=True, and saves the result.

安全使用建议

This skill appears to do what it claims (translate Excel files by sending cell text to an LLM), but exercise caution before use: 1) It will transmit spreadsheet contents to the configured OpenAI API endpoint — do NOT run it on sensitive or confidential spreadsheets unless you accept this. 2) The script will attempt to read a secrets file at ~/.openai/secret in addition to environment variables; inspect that file (and its permissions) before installing or running the skill. 3) Verify OPENAI_BASE_URL is set to the official API (https://api.openai.com/v1) — a malicious base URL would exfiltrate data to a third party. 4) Ensure required Python packages (openpyxl and an OpenAI client library) are installed from trusted sources. 5) If you want to avoid remote calls, do not provide an API key and/or run a modified local-only version; otherwise, test on non-sensitive sample files first. If you want higher assurance, ask the publisher to remove the fallback ~/.openai/secret read and to explicitly declare dependencies and credential sources.

功能分析

Type: OpenClaw Skill Name: excel-translator Version: 1.0.0 The skill is classified as suspicious due to two key vulnerabilities. First, the `SKILL.md` instructions for executing `scripts/translate.py` directly embed a user-provided file path into a shell command, creating a shell injection vulnerability if the OpenClaw agent does not properly sanitize the input. Second, `scripts/translate.py` attempts to load API credentials from `~/.openai/secret` before falling back to environment variables, posing an information disclosure risk by accessing a potentially sensitive file outside the expected environment variables. There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints or installation of backdoors.

能力评估

ℹ Purpose & Capability

The skill's name/description align with the code: it uses openpyxl to modify .xlsx files and an LLM to translate cell text. However, the SKILL.md emphasizes environment variables for credentials but the script also attempts to read credentials from ~/.openai/secret (KEY=VALUE format), which is not documented in SKILL.md. That extra file access is out-of-band relative to the stated environment-only credential approach.

⚠ Instruction Scope

SKILL.md instructs the agent to run the included script and states credentials come from environment variables, but the script explicitly reads ~/.openai/secret as a fallback. The script will batch cell contents and transmit them to the configured OpenAI API endpoint — this means spreadsheet data (which may be sensitive) is sent to an external service. The hidden file read and the lack of explicit warnings about data exfiltration are scope creep relative to a purely local translation tool.

ℹ Install Mechanism

There is no install spec (instruction-only), which minimizes installation risk. However, the script depends on Python packages (openpyxl and an OpenAI client) which are not declared in the registry metadata or SKILL.md as required installs; running it without these installed will fail. No suspicious external download/install behavior is present.

⚠ Credentials

Requesting an OpenAI API key is proportionate for a cloud-based translation. Concerns: (1) the script reads ~/.openai/secret in addition to environment variables — this may expose other keys stored there; (2) OPENAI_BASE_URL can be pointed at an arbitrary endpoint, which would cause data to be sent to that endpoint if misconfigured; (3) the script does not validate the presence of a valid API key before creating the client. These are reasonable for functionality but require the user to trust the environment and the contents of their home directory.

✓ Persistence & Privilege

The skill is not always-enabled, does not modify other skills, and does not request persistent system privileges. Its only notable privilege is read access to a secrets file in the user's home directory, which is performed at runtime and not persisted.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install excel-translator
安装完成后，直接呼叫该 Skill 的名称或使用 /excel-translator 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

- Initial release of Excel Translator Skill. - Translates Excel (.xlsx) files from English to Chinese, preserving all formatting, images, and charts. - Writes the Chinese translation below the original English text in the same cell, separated by a newline. - Supports custom output file paths and automatically appends a "_translated" suffix if not specified. - Uses OpenAI API credentials configured via environment variables in the Manus sandbox. - Provides a core Python script (`translate.py`) for streamlined translation workflow.

元数据

Slug excel-translator

版本 1.0.0

许可证 —

累计安装 2

当前安装数 1

历史版本数 1

常见问题