fcode-i18n

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill uses official vendor tools including the fcode CLI and the @factorialco/fcode-sdk library for all translation operations, ensuring interactions remain within the intended workspace environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes translation data from external YAML files which are interpolated into application text.
  • Ingestion points: Translation strings are ingested from files located in the i18n/ directory (SKILL.md).
  • Boundary markers: The documentation specifies a 'single-pass' interpolation constraint that prevents the system from rescanning substituted content for further placeholders or instructions.
  • Capability inventory: The skill provides capabilities to synchronize and update these translation files via the fcode i18n:push and save_locale tools (SKILL.md).
  • Sanitization: The platform explicitly avoids recursive scanning of placeholders, which effectively mitigates the risk of nested prompt injection through translation values.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 05:05 PM
Security Audit — agent-trust-hub — fcode-i18n