translate

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a Node.js one-liner via node -e to automate the sorting of translation files. This command reads from and writes to the local file system within the project structure.\n- [EXTERNAL_DOWNLOADS]: The script used for file sorting relies on the glob Node.js package. While glob is a well-known and standard utility, it represents an external dependency that must be available in the execution environment.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes data from translation files in apps/frontend/src/i18n/languages/*.json. If these files contain malicious instructions, they could influence the agent's behavior during the translation or sorting process.\n
  • Ingestion points: External JSON files located in the apps/frontend/src/i18n/languages/ directory.\n
  • Boundary markers: No delimiters or instructions to ignore embedded commands are present in the skill's logic.\n
  • Capability inventory: The skill possesses capabilities for local file system read/write and script execution.\n
  • Sanitization: Content from translation files is parsed and processed without validation or escaping of the string values.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 02:40 AM