fcode-i18n
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses official vendor tools including the
fcodeCLI and the@factorialco/fcode-sdklibrary for all translation operations, ensuring interactions remain within the intended workspace environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes translation data from external YAML files which are interpolated into application text.
- Ingestion points: Translation strings are ingested from files located in the
i18n/directory (SKILL.md). - Boundary markers: The documentation specifies a 'single-pass' interpolation constraint that prevents the system from rescanning substituted content for further placeholders or instructions.
- Capability inventory: The skill provides capabilities to synchronize and update these translation files via the
fcode i18n:pushandsave_localetools (SKILL.md). - Sanitization: The platform explicitly avoids recursive scanning of placeholders, which effectively mitigates the risk of nested prompt injection through translation values.
Audit Metadata