lokalise-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the
!commandsyntax to automatically executenode --version,python3 --version, anduname -awhen the skill is loaded. These commands are used for environment detection and are considered low risk. - [COMMAND_EXECUTION]: The skill performs extensive shell command execution using
curl,jq,sed,grep, andtarto gather system diagnostics and project metadata. - [DATA_EXFILTRATION]: The skill accesses potentially sensitive local files including
~/.npm/_logs/and.envto collect diagnostic information. While it includessed-based redaction logic to remove API tokens and email addresses before bundling the data, there is an inherent risk of sensitive data exposure if redaction patterns are bypassed or incomplete. - [EXTERNAL_DOWNLOADS]: The skill interacts with the official Lokalise API (
api.lokalise.com) to verify connectivity and retrieve project statistics. This is a well-known service directly related to the skill's purpose. - [DYNAMIC_EXECUTION]: Uses
node -eto programmatically check the version of the@lokalise/node-apipackage by reading itspackage.jsonfile.
Audit Metadata