beaver-markdown-i18n
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
gitbinary viaexecFilefor version control synchronization andnodeto orchestrate its own internal CLI sub-scripts. These operations are standard for a documentation management and synchronization tool. - [DATA_EXPOSURE]: Analysis confirms the tool operates exclusively on local files within the project directory. It does not hardcode credentials, perform unauthorized network requests, or access sensitive system paths (such as SSH keys or environment secrets).
- [INDIRECT_PROMPT_INJECTION]: As a translation utility, the skill processes untrusted Markdown content as data. While it employs AST parsing to isolate translatable segments and uses boundary markers (
<!-- i18n:todo -->) to define task scopes, there is a theoretical surface for indirect prompt injection if the source text contains adversarial instructions intended to influence the LLM during the translation step. - [EXTERNAL_DOWNLOADS]: The skill's
package.jsonidentifies several well-known and reputable dependencies (unified,remark-parse,js-yaml,diff) from the official NPM registry, which are necessary for its core functionality.
Audit Metadata