The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references installation methods for the Crowdin CLI from official vendor sources, including artifacts.crowdin.com and GitHub releases. These are recognized as trusted vendor resources.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute crowdin CLI commands for uploading, downloading, and managing localization project resources. It includes safety guidance on using jq for data processing.
[CREDENTIALS_UNSAFE]: The skill documents the use of API tokens and the identity file located at ~/.crowdin.yml. It correctly identifies the risks of hardcoded tokens and promotes the use of environment variables for secure credential management.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a potential surface for indirect prompt injection through the processing of localization files and integration data.
Ingestion points: The skill ingests local project source files and external content from integrations like Webflow or HubSpot (SKILL.md, references/apps.md).
Boundary markers: The instructions do not specify the use of LLM-specific boundary markers or delimiters when the agent processes or summarizes the content of these files.
Capability inventory: The agent is granted capabilities to perform network requests and file system operations via the crowdin CLI (SKILL.md, references/apps.md).
Sanitization: The skill provides excellent mitigation instructions, explicitly requiring the use of jq with the --arg flag to ensure external content is safely interpolated and cannot lead to shell command injection.

crowdin-cli