Detect the language of input text using AI with Expanso Edge via CLI or MCP pipelines.

What to check before installing: - You must have expanso-edge installed and on PATH; the SKILL.md requires this even though the registry metadata omitted it. Install via the expanso/ClawHub instructions in the README if you plan to run pipelines locally. - The pipelines use OpenAI (gpt-4o-mini) and require OPENAI_API_KEY; set a key before running. skill.yaml marks the key optional but the pipeline will not work without it — treat this as a packaging/documentation bug. - The MCP pipeline binds to 0.0.0.0:${PORT:-8080} and exposes POST /detect. If you run the MCP server, ensure you understand the network exposure (firewall, allowed clients) because any text you send will be forwarded to OpenAI for processing. - The skill sends user text to OpenAI—do not send sensitive or private data unless you are comfortable with that data going to your OpenAI account. Review your OpenAI account/config and rate/usage limits. - skill.yaml mentions a local Ollama backend (llama3.2) but the provided pipeline YAMLs call only the OpenAI processor; if you need an offline/local option, validate and test that separately. - The package has no homepage and a single owner id (unknown). That is not an active red flag by itself, but if you have a security policy about provenance, consider verifying the source or testing in a sandbox first. Overall: the skill appears to do what it claims (language detection) with no hidden data exfiltration in the provided files. The primary issues are documentation/packaging inconsistencies and the usual privacy consideration that text is sent to OpenAI.

Type: OpenClaw Skill Name: expanso-language-detect Version: 1.0.0 The skill is designed for language detection using OpenAI. However, both `pipeline-cli.yaml` and `pipeline-mcp.yaml` directly concatenate user-provided text into the LLM prompt without any apparent sanitization. This creates a prompt injection vulnerability, allowing an attacker to potentially manipulate the AI agent's behavior or output by crafting malicious input. This is a significant vulnerability, classifying the skill as suspicious.