Translate videos into a specified target language using the Keevx API. Supports audio-only translation, subtitle generation, and dynamic duration adjustment....
Security Analysis
medium confidenceThe skill's instructions match a video-translation use case, but the runtime docs require an API key and file uploads while the registry metadata claims no credentials or binaries — this mismatch and the skill's instructions to upload local files and continuously poll an external API are cause for caution.
The SKILL.md describes exactly the expected capabilities for a video-translation adapter to the Keevx API (upload local files, submit translation jobs, poll status). However the registry metadata claims no required environment variables or credentials even though the instructions explicitly require KEEVX_API_KEY — that mismatch is suspicious but the requested API key itself is coherent with the stated purpose.
Runtime instructions direct the agent to read local file paths and perform multipart uploads of local video files, submit tasks, and then immediately begin polling the external API until completion. Continuous polling and file uploads expand the agent's runtime actions beyond a single request/response and increase network activity and potential data exposure; the instructions also mandate showing a message and resuming polling on later user requests.
This is an instruction-only skill with no install spec and no code to write to disk, which minimizes installation risk.
The SKILL.md requires a secret named KEEVX_API_KEY for Authorization and upload token use, but the registry metadata lists no required environment variables. Requiring a bearer token is reasonable for a third-party API, but the metadata/manifest omission is an inconsistency that should be resolved before trusting the skill.
always is false and the skill is user-invocable (normal). However, because the instructions ask the agent to poll the remote API until job completion and the platform allows autonomous invocation by default, the skill can produce sustained outbound network activity when invoked — this increases blast radius compared to a single-shot action.
Guidance
Before installing or using this skill: (1) be aware the SKILL.md requires you to provide KEEVX_API_KEY even though the registry metadata omitted it — only proceed if you trust Keevx and understand the API key's scope. (2) The skill will upload any local video files you point it at to Keevx storage; do not upload sensitive or private videos unless you’ve checked Keevx’s privacy/data-retention policy. (3) The agent will poll the external API repeatedly until the translation finishes — expect sustained network requests and possible charges/rate limits. (4) If you provide a callback_url, the external service will POST task results to that URL — ensure that endpoint is trusted. (5) Because the skill source and homepage are unknown, prefer creating a dedicated, limited-scope API key for testing and verify the provider independently before using it with sensitive data. If possible, ask the skill author/maintainer to fix the manifest to declare KEEVX_API_KEY and to document polling behavior and data retention.
Latest Release
v1.0.0
Keevx Video Translation Skill 1.0.0 – Initial Release - Translate videos into a specified target language via Keevx API, supporting both URL and local file inputs. - Offers options for audio-only translation, subtitle generation, and dynamic video duration adjustment. - Provides endpoints to check supported target languages and to query translation task status. - Includes required user messaging: task submission always returns a task ID and re-query instructions. - Detailed setup and API authentication instructions provided in documentation.
Popular Skills
Published by @baidu-xiling on ClawHub
