The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs users to pipe shell scripts from personal GitHub repositories directly into a shell interpreter.
Evidence: curl -sfL https://raw.githubusercontent.com/nicktomlin/lokalise-cli-2-install/master/install.sh | sh in SKILL.md for CLI installation.
Evidence: curl -sfL https://raw.githubusercontent.com/nicholasgasior/gvm/master/bin/gvm | bash in references/implementation-guide.md for environment setup.
[REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute the official installation script from Lokalise's public repository.
Evidence: curl -sfL https://raw.githubusercontent.com/lokalise/lokalise-cli-2-go/master/install.sh | sh used throughout SKILL.md and references/implementation.md.
[COMMAND_EXECUTION]: Several workflows involve executing shell scripts and system commands with elevated privileges to manage binaries in CI environments.
Evidence: sudo mv ./bin/lokalise2 /usr/local/bin/lokalise2 in SKILL.md workflows.
[EXTERNAL_DOWNLOADS]: Fetches external resources including installation scripts and CLI tools from various remote locations.
Evidence: npm install -g @lokalise/cli2 in references/implementation-guide.md.
[INDIRECT_PROMPT_INJECTION]: The skill contains logic to process translation files that could be influenced by external contributors, creating a potential attack surface for malformed data to impact CI checks.
Ingestion points: src/locales/*.json files are read and processed by jq, Node.js scripts, and Vitest suites in SKILL.md (Steps 3, 4) and references/implementation-guide.md (Step 3).
Boundary markers: None identified; the scripts process local file content directly.
Capability inventory: Includes file read/write, shell execution via GitHub Actions, and environment variable access.
Sanitization: Basic structural validation using jq and object key comparisons, but lacks deep sanitization of the values within the translation files.

lokalise-ci-integration