crowdin-api-client
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard implementation patterns for the official
@crowdin/crowdin-api-clientlibrary, focusing on legitimate API interactions. - [SAFE]: Authentication is handled securely using environment variables (
process.env.CROWDIN_TOKEN), avoiding hardcoded credentials. - [SAFE]: File system access (
readFile,writeFile) and network requests (fetch) inreferences/recipes.mdare used appropriately for downloading and uploading translation assets. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses and local files, which represents a potential attack surface.
- Ingestion points: Data is read from local files via
readFileand from remote URLs viafetchinreferences/recipes.md. - Boundary markers: The provided code snippets do not include explicit delimiters or sanitization for prompt-injection threats.
- Capability inventory: The skill includes file writing (
writeFile) and network fetching (fetch) capabilities across multiple recipes. - Sanitization: No content sanitization is present in the utility functions; it handles translation data as raw buffers or strings.
Audit Metadata