baoyu-translate
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes its own TypeScript logic (scripts/main.ts) using the bun runtime or npx to perform markdown chunking. This is a controlled execution of local code bundled with the skill.
- [EXTERNAL_DOWNLOADS]: As part of its source materialization workflow, the skill fetches content from external URLs when requested by the user. This is necessary for translating web-based articles.
- [PROMPT_INJECTION]: The skill handles untrusted data which presents an indirect prompt injection surface.
- Ingestion points: Document content from user files and external URLs (documented in workflow-mechanics.md).
- Boundary markers: Instructions are separated into a shared context file (02-prompt.md), providing structure to the translation task.
- Capability inventory: The skill has capabilities for file system writes, network retrieval, and internal script execution (scripts/main.ts).
- Sanitization: No explicit filtering or sanitization of the source text is performed before it is processed by the AI agents.
Audit Metadata