Add iFLYTEK AI skills plugin

[FenjuFu]

Summary

• add iflytek-skills, a third-party skill-only plugin with eight official iFLYTEK speech, OCR, transcription, proofreading, translation, and multimodal workflows
• register the plugin in the marketplace manifest and root plugin table
• document dependencies, credential-variable families, data egress, service enablement/cost, and upstream provenance

Closes #292.

Scope and provenance

The skill packages are based on iflytek/iFly-Skills@062da188ac91ef11047e430d4ab90bbed296b97c, and the upstream Apache-2.0 license is included unchanged. Files modified for marketplace packaging carry a prominent notice.

Included skills:

• iflytek-hyper-tts
• iflytek-image-understanding
• iflytek-ocr-invoice
• iflytek-pdf-image-ocr
• iflytek-speed-transcription
• iflytek-text-proofread
• iflytek-translate
• iflytek-video-translate

The plugin has no hooks, background processes, MCP server, automatic dependency installation, or bundled credentials. The selected scripts use HTTPS or WSS service endpoints.

As proposed in #292, this initial version excludes the incomplete contract-review clients, the voice-cloning training flow that currently uses plain HTTP, and the unrelated animated-diagram skill.

Review fixes

The follow-up commits address all eight Bugbot findings across two review rounds:

• sign image OCR requests with the hostname rather than hostname plus path
• align the proofreading Host header with its signed endpoint
• hash the actual transcription request body with a single SHA-256= prefix
• retain the final chunk when a multipart upload is an exact chunk-size multiple
• allow PDF OCR with --pdf-url and no dummy local path
• provide a real --task-id transcription query path after --no-poll
• parse completed --task-id JSON into the documented text/segments shape
• honor --output for task-query results

Eight offline regression tests cover these cases.

Data boundary

Invoked skills send the requested text, image, PDF, audio, or video URL to the corresponding iFLYTEK API. The plugin README tells users to confirm organizational policy, service terms, entitlement, quota, and pricing before sending sensitive content.

Validation

• node scripts/validate-plugins.mjs — passes
• python -m compileall -q third_party/iflytek-skills/skills — passes
• upstream Hyper TTS unit test — passes in an isolated websocket-client environment
• eight marketplace packaging regression tests — pass
• all nine vendored Python entry points return --help successfully with isolated runtime dependencies
• all eight SKILL.md frontmatter blocks have matching names and descriptions
• staged whitespace and common credential-pattern scans — clean
• configured endpoint scan — no plain-HTTP endpoints
• all PR commits include matching DCO Signed-off-by trailers

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit da719bd. Configure here.}