use-ai-i18n-mcp

Warn

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill's internal utility scripts utilize dynamic module loading to resolve and execute internal components of its dependencies.
  • scripts/scan.mjs resolves the path to @ai-i18n/vite/internal/scan using require.resolve relative to a user-provided root directory and then imports it using pathToFileURL and import().
  • scripts/translations.mjs similarly resolves and dynamic-imports @ai-i18n/mcp/internal/agent based on a variable root path.
  • [COMMAND_EXECUTION]: The skill instructions provide several shell commands for installation, registration, and execution of its scanning and translation helpers.
  • Instructions in references/registration.md include commands to add skills, register MCP servers, and install plugins using npx and codex CLI tools.
  • The skill defines local scripts (scripts/scan.mjs, scripts/translations.mjs) that are intended to be executed by the agent to interact with the target application environment.
  • [EXTERNAL_DOWNLOADS]: The documentation guides the user and agent to install packages and plugins from external repositories and registries associated with the vendor.
  • references/registration.md contains instructions to download skills and the @ai-i18n/mcp@alpha package from GitHub and NPM.
  • The skill references documentation hosted at https://bosens-china.github.io/ai-i18n/llms.txt.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted data from the target application's source code and translation JSON files, creating a surface for indirect prompt injection.
  • Ingestion points: scripts/scan.mjs processes the application's entry points and dependencies; scripts/translations.mjs reads translation requests from JSON input or standard input.
  • Boundary markers: The documentation in references/plugin-hooks.md explicitly warns that diagnostics returned by plugins are untrusted data and should not be treated as instructions.
  • Capability inventory: The skill has capabilities to read filesystem content, execute internal scanning logic, and write to project translation and override files.
  • Sanitization: While the skill validates template tokens and schema structures for batch updates, it relies on the agent to handle natural language content which could contain embedded instructions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 24, 2026, 06:15 AM