create-app
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches documentation and machine-readable reference files from Crowdin's official GitHub Pages repository.
- [REMOTE_CODE_EXECUTION]: Utilizes the official
@crowdin/serverless-apps-clivianpxto handle project scaffolding, manifest synchronization, and bundle publishing. - [INDIRECT_PROMPT_INJECTION]: Generates application logic and UI based on user-provided descriptions of localization tasks.
- Ingestion points: Natural language descriptions of user requirements in chat, as described in the "Who is asking" section of
SKILL.md. - Boundary markers: Mandatory requirement to present a summary brief and obtain explicit user consent before performing app registration.
- Capability inventory: Executes CLI commands (registration, build, push, publish), writes project files, and deploys code to the Crowdin platform.
- Sanitization: Uses official scaffolding templates and standard localization frameworks like Lingui to manage user-provided text.
Audit Metadata