make-site-multilingual

Pass

Audited by Gen Agent Trust Hub on Nov 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes Node.js scripts and shell commands to manage site internationalization. Specifically, scripts/fix-rosey-pages.mjs performs filesystem operations (read, write, delete) on the project's build directory to adjust canonical URLs and sitemaps. These operations are scoped to the project output and align with the skill's purpose.\n- [EXTERNAL_DOWNLOADS]: The instructions require the installation of the rosey and rosey-cloudcannon-connector npm packages. These are official tools provided by the vendor, CloudCannon, for the intended internationalization workflow. The usage of these packages is considered safe as they are part of the vendor's ecosystem.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading and processing the HTML files of the website being translated. This ingestion point is located in the build directory as specified in the post-build instructions. While no explicit boundary markers or sanitization are mentioned for this data processing, the risk is low because the capabilities (local file modifications) are consistent with the primary skill purpose and do not involve dangerous sinks like network exfiltration or shell injection of external data.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 3, 2026, 08:12 PM