Add iFLYTEK AI skills plugin

[FenjuFu]

Summary

• add iflytek-skills, a third-party skill-only plugin with eight official iFLYTEK speech, OCR, transcription, proofreading, translation, and multimodal workflows
• register the plugin in the marketplace manifest and root plugin table
• document dependencies, credential-variable families, data egress, service enablement/cost, and upstream provenance

Closes #292.

Scope and provenance

The skill packages are based on iflytek/iFly-Skills@062da188ac91ef11047e430d4ab90bbed296b97c, and the upstream Apache-2.0 license is included unchanged. Files modified for marketplace packaging carry a prominent notice.

Included skills:

• iflytek-hyper-tts
• iflytek-image-understanding
• iflytek-ocr-invoice
• iflytek-pdf-image-ocr
• iflytek-speed-transcription
• iflytek-text-proofread
• iflytek-translate
• iflytek-video-translate

The plugin has no hooks, background processes, MCP server, automatic dependency installation, or bundled credentials. The selected scripts use HTTPS or WSS service endpoints.

As proposed in #292, this initial version excludes the incomplete contract-review clients, the voice-cloning training flow that currently uses plain HTTP, and the unrelated animated-diagram skill.

Review fixes

The follow-up commits address all eight Bugbot findings across two review rounds:

• sign image OCR requests with the hostname rather than hostname plus path
• align the proofreading Host header with its signed endpoint
• hash the actual transcription request body with a single SHA-256= prefix
• retain the final chunk when a multipart upload is an exact chunk-size multiple
• allow PDF OCR with --pdf-url and no dummy local path
• provide a real --task-id transcription query path after --no-poll
• parse completed --task-id JSON into the documented text/segments shape
• honor --output for task-query results

Eight offline regression tests cover these cases.

Data boundary

Invoked skills send the requested text, image, PDF, audio, or video URL to the corresponding iFLYTEK API. The plugin README tells users to confirm organizational policy, service terms, entitlement, quota, and pricing before sending sensitive content.

Validation

• node scripts/validate-plugins.mjs — passes
• python -m compileall -q third_party/iflytek-skills/skills — passes
• upstream Hyper TTS unit test — passes in an isolated websocket-client environment
• eight marketplace packaging regression tests — pass
• all nine vendored Python entry points return --help successfully with isolated runtime dependencies
• all eight SKILL.md frontmatter blocks have matching names and descriptions
• staged whitespace and common credential-pattern scans — clean
• configured endpoint scan — no plain-HTTP endpoints
• all PR commits include matching DCO Signed-off-by trailers

---

Note

Medium Risk
New third-party plugin that egresses user text/media to external iFLYTEK APIs and relies on multiple credential env-var families; risk is bounded to the new package but reviewers should confirm data-boundary docs and packaging auth fixes.

Overview
Adds the iFLYTEK Skills integration plugin to the Cursor marketplace by registering iflytek-skills in marketplace.json and the root README, alongside a new third_party/iflytek-skills package (manifest, Apache-2.0 license, changelog, and plugin README).

The plugin ships eight agent skills—hyper TTS, image understanding, invoice OCR, PDF/image OCR, speed transcription, Chinese text proofreading, machine translation, and video translation—each with SKILL.md guidance and on-invoke Python CLIs that call iFLYTEK HTTPS/WSS APIs. User content is sent to those endpoints only when a skill runs; credentials come from documented env vars (XFEI_*, IFLY_*, XFYUN_*), with no bundled secrets, hooks, or MCP.

Packaging layers targeted fixes on upstream iFly-Skills (image OCR HMAC host signing, proofreading Host headers, transcription request digests and multipart uploads, --task-id / --no-poll flows, URL-only PDF OCR) plus regression tests for those behaviors. Some upstream workflows are intentionally omitted (contract review, voice cloning, animated diagram).

^{Reviewed by Cursor Bugbot for commit 636eaf9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 90d3dd8. Configure here.}