paraglide-js
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents configuration settings that fetch official plugins and SDKs from JSDelivr, a well-known content delivery network. These include the
@inlang/paraglide-jsplugin and the@anthropic-ai/sdk, which originate from recognized and trusted organizations. - [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture that processes translation files, representing a potential surface for indirect injection if translation content is provided by untrusted actors.
- Ingestion points: Translation source files (e.g.,
messages/*.json) loaded by the Paraglide compiler and used by the generated runtime. - Boundary markers: The library uses specific interpolation and markup syntax to delimit dynamic content, providing structural separation for translation values.
- Capability inventory: The skill documents capabilities including message function execution, JSON parsing of localized strings, and dynamic rendering of markup tags in various UI frameworks (React, Vue, Svelte, Solid).
- Sanitization: Relies on developer-defined markup handlers to safely render content when using the markup system.
Audit Metadata