Skills
skills/sumik5/sumik-claude-plugin/translating-with-lmstudio/Gen Agent Trust Hub

translating-with-lmstudio

Pass

Audited by Gen Agent Trust Hub on Mar 6, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection in the cmd_translate function within scripts/lmstudio-translate.py.
  • Ingestion points: Untrusted text enters the system via the --text CLI argument or stdin when calling the script.
  • Boundary markers: The prompt template lacks delimiters or explicit instructions to isolate the user-provided text from the system's translation instructions.
  • Capability inventory: The skill can execute shell commands for package management and make network requests to localhost.
  • Sanitization: No escaping or validation is applied to the input text before it is concatenated into the final LLM prompt.
  • [EXTERNAL_DOWNLOADS]: The skill references and downloads the openai Python package from the official PyPI registry. This installation is automated both in the setup instructions and at script runtime.
  • [COMMAND_EXECUTION]: The script scripts/lmstudio-translate.py uses subprocess.check_call to programmatically run pip install, representing dynamic execution of system commands for dependency management.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 6, 2026, 02:12 PM