crowdin
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the
@useclawlink/clipackage executed vianpxto perform authentication (login,connect) and resource management (actions,describe,run). These are standard operations for the Crowdin integration. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by reading external data from Crowdin projects.
- Ingestion points: Data is ingested into the agent context through CLI commands like
npx @useclawlink/cli actions crowdinandnpx @useclawlink/cli run crowdininSKILL.md. - Boundary markers: The skill does not define specific boundary markers or instructions to ignore embedded content within the project data.
- Capability inventory: The agent has the capability to execute shell commands using the
npxtool. - Sanitization: No explicit sanitization or validation of the Crowdin data is described in the skill metadata or instructions.
Audit Metadata