feat(skills): add iFLYTEK skills plugin

[FenjuFu]

Summary

• add iflytek-skills, a third-party skill-only plugin with eight official iFLYTEK speech, OCR, transcription, proofreading, translation, and multimodal workflows
• register the plugin in the marketplace manifest and root plugin table
• document dependencies, credentials, data egress, service enablement/cost, and upstream provenance

Closes #292.

Scope and provenance

The skill packages are based on iflytek/iFly-Skills@beb3ae3a16d9ba952303acac1eb801f234d9c348, and the upstream Apache-2.0 license is included unchanged. Files modified for marketplace packaging carry a prominent notice.

Included skills:

• iflytek-hyper-tts
• iflytek-image-understanding
• iflytek-ocr-invoice
• iflytek-pdf-image-ocr
• iflytek-speed-transcription
• iflytek-text-proofread
• iflytek-translate
• iflytek-video-translate

The plugin has no hooks, background processes, MCP server, automatic dependency installation, or bundled credentials. The selected scripts use HTTPS or WSS service endpoints.

As proposed in #292, this initial version excludes the incomplete contract-review clients, the voice-cloning training flow (it still uses plain HTTP at the pinned revision), and the unrelated animated-diagram skill.

Packaging fixes

Upstream has since unified credentials under IFLY_* (with XFEI_*/XFYUN_* fallback) and fixed the transcription request digest, multipart chunking, and task-query flow. Those parts of this PR now come straight from upstream, so the remaining packaging changes are:

• sign image OCR requests with the hostname rather than hostname plus path
• generate locale-independent GMT authentication dates for image OCR and Hyper TTS
• normalize image OCR suffixes to the lowercase encoding values accepted by the service
• align the proofreading Host header with its signed endpoint
• allow PDF OCR with --pdf-url and no dummy local path
• expose the seven speed-transcription task options (--output-type, --postproc-on, --enable-subtitle, --smoothproc, --colloqproc, --language-type, --dhw) that its SKILL.md documents but the CLI rejected. This is also submitted upstream as fix(speed-transcription): expose documented task options in the CLI iflytek/iFly-Skills#106.

Seven offline runtime regression tests and two Hyper TTS tests cover these cases.

Data boundary

Invoked skills send the requested text, image, PDF, audio, or video URL to the corresponding iFLYTEK API. The plugin README tells users to confirm organizational policy, service terms, entitlement, quota, and pricing before sending sensitive content.

Validation

• node scripts/validate-plugins.mjs passes
• python -m compileall -q third_party/iflytek-skills passes
• seven marketplace runtime regression tests pass
• two Hyper TTS unit tests pass
• all PR commits include DCO Signed-off-by trailers

---

Note

Medium Risk
Adds a third-party integration that sends user text, images, audio, and video URLs to external iFLYTEK APIs when skills are invoked; risk is mainly credential handling and sensitive data leaving the environment, not core repo behavior.

Overview
Adds the iFLYTEK Skills third-party plugin (iflytek-skills) to the marketplace and documents it in the root README. The package vendors eight agent skills (hyper TTS, image understanding, invoice OCR, PDF/image OCR, speed transcription, text proofread, translate, video translate) under third_party/iflytek-skills/, based on upstream iflytek/iFly-Skills with Cursor-specific packaging fixes.

Skills run as on-demand local Python CLIs that call iFLYTEK HTTPS/WSS APIs using user-supplied IFLY_* credentials (with legacy XFEI_* / XFYUN_* namespace fallback). The README and changelog call out data egress, optional pip deps (requests, websocket-client, etc.), and excluded upstream workflows.

Packaging fixes on top of the pinned upstream revision include locale-independent auth dates for Hyper TTS, corrected image OCR HMAC host/signing and encoding, proofreading Host header alignment, URL-only PDF OCR, and extra speed-transcription CLI flags documented in SKILL.md. Regression and Hyper TTS unit tests cover those changes.

^{Reviewed by Cursor Bugbot for commit 8de61d8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[FenjuFu]

Refreshed this branch: merged current main to resolve the marketplace.json/README conflicts, and re-based the vendored skills on upstream iFly-Skills@beb3ae3. Upstream now covers the transcription fixes and the IFLY_* credential unification, so the local patch set is smaller. The one new packaging change exposes the speed-transcription options that its SKILL.md documents but the CLI rejected; that is also submitted upstream as iflytek/iFly-Skills#106. Validator, compileall, and the five packaging regression tests all pass locally.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 5636e26. Configure here.}

[FenjuFu]

Merged current main in 5636e26 and resolved the marketplace and README conflicts, keeping both the new Tailscale entry and the iFLYTEK plugin. The plugin validator, seven runtime regression tests, two Hyper TTS tests, Python compilation and diff checks pass. The tests use mocked service responses and do not make live API calls.