lokalise-common-errors
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill correctly uses the
LOKALISE_API_TOKENenvironment variable to handle authentication, which is a secure practice. Network operations viacurlandurllibare directed solely to official Lokalise domains (api.lokalise.com,status.lokalise.com). No exfiltration patterns to third-party or unknown domains were found. - [REMOTE_CODE_EXECUTION]: No remote code downloads or execution from untrusted sources are present. The skill provides local diagnostic bash scripts and code examples that interact with the official Lokalise API.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes
PROJECT_ID,KEY_ID, and raw JSON responses from the Lokalise API (SKILL.md, implementation-guide.md). - Boundary markers: Not explicitly defined in code snippets, but instructions focus on structured data handling.
- Capability inventory: Includes
curl(network),bash(shell), andlokalise2(CLI tool). - Sanitization: The skill provides logic for validating JSON formats and project ID structures, which serves as a mitigation for malformed or malicious API responses.
- [OBFUSCATION]: No obfuscated strings, Base64 commands, or hidden Unicode characters were detected in the instructions or code references.
Audit Metadata