lokalise-ci-integration

SUSPICIOUS: the skill’s purpose and API/data flows mostly match a legitimate Lokalise CI integration, but install trust is inconsistent and disproportionate. The main concern is the unpinned raw-GitHub curl|sh installer—especially the personal-repo prerequisite—combined with forwarding a write-capable Lokalise token to the installed CLI.

The code implements legitimate Lokalise translation CI/CD integration and contains no clear malicious payload or intentional data theft. It has moderate supply-chain and CI security risks because it pipes an unpinned remote script to bash, installs an unpinned global npm CLI, and automatically commits and pushes externally downloaded translation files without strong validation or webhook authorization checks. Pin external dependencies and verify checksums or trusted releases, validate translation schemas and paths, restrict workflow permissions, and protect the push operation.

No clear malicious behavior is present in the supplied code. The implementation performs expected Lokalise API and translation synchronization operations. The unpinned curl | sh installer is a significant supply-chain security weakness and should be replaced with a pinned, checksum-verified release or a trusted prebuilt action. Automatic commit and push should also be constrained with least-privilege credentials and branch protections.