Summon Translator Skill

Translate safety procedures, supplier documents, and Articulate Rise 360 eLearning content into 137+ languages using AI. Built for supply chain teams, HSE pr...

This skill appears to do exactly what it says: it uploads files to summontranslator.com using a SUMMON_API_KEY to create translation jobs. Before installing or using it, verify the vendor (summontranslator.com), review their privacy/data-retention and billing policies (uploads are billed per word), and confirm whether your organization can send the specific documents (SDS, JSAs, supplier forms) to a third party. Test with non-sensitive files first, keep your SUMMON_API_KEY secret (store it in a secure secrets manager), and consider rotating/revoking the key if you stop using the service. If your organization requires on‑prem or stricter data controls for safety-critical content, request an enterprise/isolated deployment or avoid uploading such files.

Type: OpenClaw Skill Name: summon-translator-skill Version: 1.0.0 The summon-translator-skill bundle (SKILL.md) facilitates document translation via the summontranslator.com API. It is classified as suspicious due to shell injection vulnerabilities where user-controlled parameters (e.g., file_path, target_languages) and API-provided strings (e.g., downloadUrl) are directly interpolated into curl commands. Additionally, the documentation references non-existent, future-dated AI models like 'claude-haiku-4-5-20251001', which is anomalous, though no clear evidence of intentional malice or unauthorized data exfiltration was found.