crowdin-cli
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the Crowdin CLI from official sources such as NPM (@crowdin/cli), Homebrew, Docker, and GitHub releases. These are well-known and trusted vendor distribution channels.\n- [CREDENTIALS_UNSAFE]: The documentation guides the user on managing API tokens. It correctly highlights security best practices, such as using environment variables (CROWDIN_PERSONAL_TOKEN) and identity files (~/.crowdin.yml) instead of hardcoding secrets in version-controlled configuration files.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates reading and writing localization strings from local project files. 1. Ingestion points: Local project files (globs in crowdin.yml). 2. Boundary markers: Absent in CLI output. 3. Capability inventory: upload, download, auto-translate, and string management. 4. Sanitization: Managed by the Crowdin platform and CLI logic. While this creates an ingestion surface for potentially untrusted data, it is the core functionality of the localization tool.
Audit Metadata