how-to-crowdin
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches catalog and documentation data from official Crowdin domains, such as
store.crowdin.comandsupport.crowdin.com, to provide the agent with current information on platform features and marketplace applications. These are well-known vendor resources and are used for informational purposes within the skill's triage logic. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied descriptions of localization problems to determine the appropriate resolution path, creating a surface for indirect instructions.
- Ingestion points: User-provided problem descriptions in
SKILL.mdand report IDs inreferences/reports.mdare ingested into the agent's context to be mapped to solutions. - Boundary markers: The skill contains explicit guardrails requiring user confirmation before the agent performs any bulk operations or modifications, such as labeling many strings or deleting translations.
- Capability inventory: The skill recommends actions performed via specialized hand-off skills for API interaction (
crowdin-api-client), database queries (croql,graphql), and file synchronization (crowdin-cli). - Sanitization: The instructions emphasize a triage-only approach and manual confirmation rather than automated execution of user-supplied parameters.
Audit Metadata