Pilot Translate

Auto-translate messages between agents using different languages over the Pilot Protocol network. Use this skill when: 1. You need cross-language communicati...

This skill appears to do what it says, but there are several gaps you should address before using it: - Required tools not declared: The examples use 'trans'/'translate-cli' and 'jq' but the skill only declares 'pilotctl'. Make sure those tools are installed from trusted package repos (apt, brew, distro packages) and update the skill metadata to list them. - Avoid downloading executables from short URLs: The README suggests 'wget git.io/trans' — don't run that blind. Prefer installing translate-shell from an official release or your package manager, and inspect any binaries before moving them into /usr/local/bin. - API keys not declared: The doc mentions DeepL but does not declare env vars for API keys or how to store them. If you plan to use API-based translators, require and provide guidance for scoped credentials (and avoid placing secrets in scripts). - Sandbox and least privilege: Run these commands in a controlled environment until you trust the sources (container or VM) so a downloaded executable cannot affect your host. What would increase confidence: an updated SKILL.md or metadata that lists all required binaries (trans/translate-cli, jq), explicit, auditable install links (no URL shorteners), and declared environment variables for any API keys with guidance on secure storage. If those changes are made, this skill would likely be coherent and low-risk; as-is, treat it with caution.

Type: OpenClaw Skill Name: pilot-translate Version: 1.0.0 The skill instructions in SKILL.md include high-risk commands for the agent to download a binary from a shortened URL (git.io/trans) and install it using sudo, which is a dangerous pattern for automated agents. Additionally, the provided Bash workflow examples are vulnerable to shell injection because they pipe unquoted or unsanitized message variables directly into shell commands. While these behaviors are plausibly intended for the stated purpose of setting up translation tools, they introduce significant security risks without proper safeguards.