nextjs-json-i18n-ai-translate
Warn
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to execute
npx @thor123141245r/ai-translate. This command downloads the specified package from the public NPM registry at runtime. The package and its author (@thor123141245r) are not recognized as trusted or well-known entities. - [COMMAND_EXECUTION]: The skill uses
npxto execute external code. This grants the downloaded package the ability to run arbitrary commands on the host system with the agent's permissions. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8).
- Ingestion points: The skill reads contents from local JSON files (e.g.,
en.json) located in directories likesrc/i18normessages. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the JSON values are provided in the prompt templates.
- Capability inventory: The skill has the capability to execute shell commands via
npxand write to the file system (generating target locale JSON files). - Sanitization: There is no evidence of sanitization or validation of the JSON content before it is processed by the translation tool.
Audit Metadata