code-translation

Warn

Audited by Gen Agent Trust Hub on May 10, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: Step 6 ('Test the Translation') provides a Python verification template that uses subprocess.run to execute generated code. Following these instructions would cause the agent to run shell commands to execute the translated files (e.g., python solution.py, node solution.js).
  • [REMOTE_CODE_EXECUTION]: Because the skill processes untrusted user-provided code as input for translation, the recommended verification step (executing that code) effectively allows for remote code execution if the input is malicious.
  • [PROMPT_INJECTION]: The skill lacks explicit boundary markers or sanitization instructions for the source code it ingests. This creates a surface for indirect prompt injection where instructions embedded within the code comments or string literals of the input could influence agent behavior during the translation or testing phase.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 10, 2026, 05:21 PM
Security Audit — agent-trust-hub — code-translation