find-missing-translations
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a sequence of shell utilities including
grep,sed,comm, andsortto compare Android XML resource files. It employs process substitution andwhileloops to identify missing keys and extract values for translation. - [COMMAND_EXECUTION]: A command injection surface exists in Step 3 where the
$keyvariable is interpolated into agrepcommand string within double quotes (grep "name=\"$key\""). This allows for shell expansion of the variable's content if the source XML files contain maliciously craftednameattributes. - Ingestion points:
amethyst/src/main/res/values/strings.xmland target locale files. - Boundary markers: Absent; the script does not isolate the extracted data from the shell command logic.
- Capability inventory: Shell execution capabilities (grep, bash subshells) are used to process project data.
- Sanitization: Absent; the skill does not perform escaping or validation on the resource keys extracted from the XML files before using them in shell variables.
Audit Metadata