globalize-guide
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs several well-known i18n libraries from the npm registry, such as @lingui/core, next-intl, and vue-i18n. It also references specific vendor plugins for the inlang compiler from cdn.jsdelivr.net, which is consistent with the skill's intended functionality and author context.
- [COMMAND_EXECUTION]: To set up and verify the i18n environment, the skill executes standard development commands including npm install, npx, bundle install (for Rails projects), ./gradlew lint (for Android), and xcrun xcstringstool (for iOS). These operations are restricted to the local project context and follow standard development practices.
- [DATA_EXFILTRATION]: As part of its primary purpose, the skill assembles project metadata such as repository names and locales to facilitate connection with the translation platform. These operations are performed by delegating to specialized setup skills, ensuring that project secrets and sensitive files remain protected.
- [PROMPT_INJECTION]: While an indirect prompt injection surface exists because the skill reads project files like READMEs and source code, the subagent prompts are structured and focused on specific internationalization tasks, which mitigates the risk of unintended instruction execution.
Audit Metadata