i18n-localization
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOW
Full Analysis
- Category 1: Prompt Injection (SAFE): No instructions attempting to override agent behavior or bypass safety filters were detected in the markdown or the Python script.
- Category 2: Data Exposure & Exfiltration (SAFE): The skill accesses local project files for the purpose of linting. It does not target sensitive paths (like .ssh or .env) and performs no network operations (curl, wget, or requests) to exfiltrate data.
- Category 3: Obfuscation (SAFE): All code and instructions are in plain text. No Base64 encoding, zero-width characters, or homoglyphs were found.
- Category 4: Unverifiable Dependencies & Remote Code Execution (SAFE): The script uses only standard Python libraries (sys, re, json, pathlib). No external package installations or remote script executions are present.
- Category 8: Indirect Prompt Injection (LOW): The skill processes untrusted external content (source code files) and prints matches to standard output. While an attacker could place malicious instructions in a string to be printed by the linter, the skill lacks the high-privilege capabilities (like file-writing or command execution) to act on such instructions, making it a display-only vector.
- Category 10: Dynamic Execution (SAFE): No use of eval(), exec(), or unsafe deserialization (pickle) was detected. JSON parsing is handled with the safe json.loads() method.
Audit Metadata