dsh-translate-docs

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes project-specific scripts via the pnpm package manager, including gen-translation-brief, verify-translation-pairing, and doc-sync. These scripts are used for generating diffs, structure validation, and recording document consistency hashes.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process documentation files (.md, .zh.md), which creates a surface for indirect prompt injection if those files contain instructions aimed at the agent.
  • Ingestion points: The skill processes Markdown document pairs (foo.md, foo.zh.md) as described in SKILL.md.
  • Boundary markers: The workflow includes strict fidelity requirements, instructing the agent to restate semantic units natively while confirming nothing is added or dropped, and to perform a clause-by-clause verification.
  • Capability inventory: The skill can execute local shell commands via pnpm and perform file-write operations to update document hashes and switcher links.
  • Sanitization: The process incorporates automated checks for structure validation, link integrity, and Markdown formatting via the doc-sync and pairing gate utilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 01:53 AM
Security Audit — agent-trust-hub — dsh-translate-docs