The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx @useclawlink/cli, which fetches the ClawLink command-line utility from the npm registry. This package is the official tool provided by the author, clawlink-hq.
[REMOTE_CODE_EXECUTION]: The use of npx facilitates the download and immediate execution of remote code. This behavior is confined to the vendor's own CLI tool for the intended purpose of the skill.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to interact with Crowdin, including listing actions, describing inputs, and running translation tasks.
[CREDENTIALS_UNSAFE]: The documentation mentions the path ~/.clawlink/credentials.json where the CLI stores session keys. While it identifies a sensitive file location, it does not instruct the agent to access or exfiltrate the file.
[PROMPT_INJECTION]: The skill processes data from Crowdin projects, which serves as an external attack surface for indirect prompt injection. Ingestion points: Data and metadata from Crowdin projects and localization files retrieved via the CLI. Boundary markers: The instructions explicitly mandate that the agent must confirm with the user before performing any write operations. Capability inventory: Shell command execution via npx and the ClawLink CLI. Sanitization: No specific automated sanitization or filtering of the external Crowdin data is described in the skill instructions.

crowdin